From df9070a47dca05e26767787a3b4e6643ca1f2df0 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 10:06:01 -1000 Subject: Check that markup inside a token is escaped Every escape the checks looked at sat between tokens or in the tail a lexer left untagged, so a filter that escaped only those would have passed with a string literal reaching the page raw. --- tests/extensions/test-syntax-highlight.lua | 3 +++ 1 file changed, 3 insertions(+) (limited to 'tests/extensions') diff --git a/tests/extensions/test-syntax-highlight.lua b/tests/extensions/test-syntax-highlight.lua index 8acbf91..b54dc84 100644 --- a/tests/extensions/test-syntax-highlight.lua +++ b/tests/extensions/test-syntax-highlight.lua @@ -59,6 +59,9 @@ h.contains("bytes between tokens are escaped", out, " & ") h.contains("later tokens still highlight", out, "zz") h.equals("close answers zero", ret, 0) +out = render("hello.fake", "'&'") +h.equals("markup inside a token is escaped", out, "'<b>&'") + out = render("hello.fake", "$color :hover") h.contains("a css property takes the number class", out, "$color") h.contains("a css pseudo-class takes the function class", out, ":hover") -- cgit 2.12.1