index : cgit

-- Unit checks for custom/extensions/about-render.lua, run under a standalone
-- Lua by t0501-about-render.sh with the script path as the first argument.
-- The second argument may be nolpeg, which makes the lpeg module fail to
-- load so the escaped plain text fallback is proven even on a machine where
-- lpeg is installed. Without it the markdown and man checks run when lpeg is
-- present and are skipped with a note when it is not, the same way the
-- filter itself degrades.

local test_directory = arg[0]:match("^(.*)/") or "."
local h = dofile(test_directory .. "/harness.lua")

local script = arg[1]
local mode = arg[2] or ""

local has_lpeg = false
if mode == "nolpeg" then
	h.preload_failure("lpeg")
else
	has_lpeg = pcall(require, "lpeg")
	if not has_lpeg then
		io.write("lpeg not installed, markdown and man checks skipped\n")
	end
end

h.load(script)

local function render(filename, text)
	return h.run({ filename }, { text })
end

-- A readme tracked in a repository comes with the url of its tree.
local function render_tree(filename, query, text)
	return h.run({ filename, "/r/tree/", query }, { text })
end

-- Dispatch and the plain text rendering need nothing but the script itself,
-- so they run whatever became of lpeg.

local out, ret = render("README", "plain <text> & more")
h.contains("no extension renders as plain text", out,
	"<pre class='plaintext'>plain &lt;text&gt; &amp; more</pre>")
h.equals("close answers zero", ret, 0)

out = render("notes.txt", "just text")
h.contains("an unknown extension renders as plain text", out, "<pre class='plaintext'>just text</pre>")

out = render(nil, "no name at all")
h.contains("a missing filename renders as plain text", out,
	"<pre class='plaintext'>no name at all</pre>")

-- cgit's C sink stops at the first NUL byte, which the script documents, so
-- the text past one is lost while the wrapper written separately survives.
out = render("README", "before\0after")
h.contains("text before a nul byte survives", out, "before")
h.excludes("text after a nul byte is dropped", out, "after")
h.contains("the wrapper written after the text survives", out, "</pre>")

out = h.run({ "README" }, { "two ", "writes" })
h.contains("writes are joined before rendering", out, "two writes")

if mode == "nolpeg" then
	out = render("README.md", "# Title")
	h.contains("markdown without lpeg falls back to plain text", out, "<pre class='plaintext'># Title</pre>")
	out = render("page.1", ".SH NAME")
	h.contains("man without lpeg falls back to plain text", out, "<pre class='plaintext'>.SH NAME</pre>")
	h.finish()
end

if not has_lpeg then
	h.finish()
end

-- Markdown.

out = render("README.md", "# Title")
h.contains("a heading renders inside the wrapper", out, "<div class='markdown'><h1 id='title'>Title</h1></div>")

out = render("README.md", "## Sub ##")
h.contains("trailing hashes are stripped from a heading", out, "<h2 id='sub'>Sub</h2>")

out = render("README.md", "# C#")
h.contains("a hash ending a word stays in the heading", out, "<h1 id='c'>C#</h1>")

out = render("README.md", "## The `run` [Command](x), Again!")
h.contains("an anchor is the heading's text in lower case", out, "<h2 id='the-run-command-again'>")

out = render("README.md", "# Twice\n# Twice\n# twice")
h.contains("a repeated anchor is counted", out, "<h1 id='twice'>Twice</h1><h1 id='twice-1'>Twice</h1><h1 id='twice-2'>")

out = render("README.md", "# About")
h.contains("no heading takes an id of the page", out, "<h1 id='about-1'>")

out = render("README.md", "# ???")
h.contains("a heading of punctuation gets no anchor", out, "<h1>???</h1>")

out = render("README.MD", "# Upper")
h.contains("the extension matches whatever its case", out, "<h1 id='upper'>Upper</h1>")

out = render("readme.markdown", "# Long")
h.contains("the long markdown extension dispatches too", out, "<h1 id='long'>Long</h1>")

out = render("README.md", "line one\nline two")
h.contains("the lines of a paragraph run together", out, "<p>line one\nline two</p>")

out = render("README.md", "first para\r\nsecond line")
h.contains("crlf line endings are normalised", out, "<p>first para\nsecond line</p>")

out = render("README.md", "one  \ntwo\\\nthree")
h.contains("two trailing spaces break the line", out, "<p>one<br>\ntwo")
h.contains("a trailing backslash breaks the line", out, "two<br>\nthree</p>")

out = render("README.md", "spaces  \n\nslash\\")
h.contains("the last line takes no break", out, "<p>spaces</p><p>slash\\</p>")

out = render("README.md", "a **bold** and *leaning* word")
h.contains("double stars embolden", out, "<strong>bold</strong>")
h.contains("single stars lean", out, "<em>leaning</em>")

out = render("README.md", "an __up__ and _down_ word")
h.contains("double underscores embolden", out, "<strong>up</strong>")
h.contains("single underscores lean", out, "<em>down</em>")

out = render("README.md", "snake_case_name and _lean_ and foo__bar__")
h.contains("underscores inside words stay literal", out, "<p>snake_case_name and <em>lean</em> and foo__bar__</p>")

out = render("README.md", "_a_b_ and __c_d__")
h.contains("emphasis spans an underscore inside a word", out, "<p><em>a_b</em> and <strong>c_d</strong></p>")

out = render("README.md", "\\*not leaning\\* and \\# and \\q")
h.contains("a backslash makes punctuation literal", out, "<p>*not leaning* and # and \\q</p>")

out = render("README.md", "\\# not a heading")
h.contains("an escaped hash starts no heading", out, "<p># not a heading</p>")

out = render("README.md", "`a\\*b`")
h.contains("code keeps its backslashes", out, "<code>a\\*b</code>")

out = render("README.md", "&copy; &#169; &#xA9; &amp;")
h.contains("character references pass through", out, "<p>&copy; &#169; &#xA9; &amp;</p>")

out = render("README.md", "AT&T & &#xZZ; &#12345678;")
h.contains("a bare ampersand is escaped", out, "<p>AT&amp;T &amp; &amp;#xZZ; &amp;#12345678;</p>")

out = render("README.md", "`&amp;`")
h.contains("code shows a reference as written", out, "<code>&amp;amp;</code>")

out = render("README.md", "run `x < y` here")
h.contains("inline code is escaped", out, "<code>x &lt; y</code>")

out = render("README.md", "raw <script>alert(1)</script> here")
h.contains("markup in text reaches the page escaped", out, "&lt;script&gt;alert(1)&lt;/script&gt;")
h.excludes("no live tag slips through", out, "<script>")

out = render("README.md", "[docs](https://example.com/docs)")
h.contains("an https link renders as an anchor", out, "<a href='https://example.com/docs'>docs</a>")

out = render("README.md", "[docs](docs/page.html)")
h.contains("with no tree a relative link stays as written", out, "<a href='docs/page.html'>docs</a>")

out = render_tree("README.md", "", "[road](ROADMAP.md)")
h.contains("a relative link leads into the tree", out, "<a href='/r/tree/ROADMAP.md'>road</a>")

out = render_tree("docs/README.md", "", "[a](guide.md#setup) [b](../NEWS) [c](/src/x.c)")
h.contains("a link resolves against the readme's directory", out, "href='/r/tree/docs/guide.md#setup'")
h.contains("dot segments fold", out, "href='/r/tree/NEWS'")
h.contains("a leading slash names the root", out, "href='/r/tree/src/x.c'")

out = render_tree("docs/README.md", "", "[up](../../../etc/passwd)")
h.contains("no link climbs above the root", out, "href='/r/tree/etc/passwd'")

out = render_tree("README.md", "?h=next", "[a](NEWS#top)")
h.contains("the ref's query comes before the fragment", out, "href='/r/tree/NEWS?h=next#top'")

out = render_tree("README.md", "&h=next", "[a](NEWS)")
h.contains("the query is escaped for the attribute", out, "href='/r/tree/NEWS&amp;h=next'")

out = render_tree("README.md", "", "[a](my%20file.md) [b](a&b.md) [c](f.md?plain=1)")
h.contains("an encoded path is encoded only once", out, "href='/r/tree/my%20file.md'")
h.contains("a path is escaped for the url", out, "href='/r/tree/a%26b.md'")
h.contains("a query in a link is dropped", out, "href='/r/tree/f.md'")

out = render_tree("README.md", "", "[a](x%00y)")
h.contains("an encoded nul stays encoded", out, "href='/r/tree/x%2500y'")

out = render_tree("README.md", "", "[a](#usage) [b](https://example.com/x)")
h.contains("a fragment stays on the page", out, "href='#usage'")
h.contains("an absolute link is left alone", out, "href='https://example.com/x'")

out = render("README.md", "[mail](mailto:a@example.com)")
h.contains("a mailto link renders as an anchor", out, "<a href='mailto:a@example.com'>mail</a>")

out = render("README.md", "see <https://example.com/a?b=1> or <me@example.com>")
h.contains("a url in angle brackets links", out, "<a href='https://example.com/a?b=1'>https://example.com/a?b=1</a>")
h.contains("an address in angle brackets links", out, "<a href='mailto:me@example.com'>me@example.com</a>")

out = render("README.md", "<javascript:alert(1)> and <b>")
h.excludes("an unsafe autolink renders no anchor", out, "<a ")
h.contains("other angle brackets stay text", out, "&lt;b&gt;")

out = render("README.md", "[bad](javascript:alert(1))")
h.excludes("a javascript link renders no anchor", out, "<a ")
h.contains("its text still reaches the page", out, "bad")

out = render("README.md", "[bad](java\nscript:alert(1))")
h.excludes("a split scheme is still caught", out, "<a ")

out = render("README.md", "[bad](//evil.example/x)")
h.excludes("a scheme relative link renders no anchor", out, "<a ")

out = render("README.md", "[q](https://example.com/a'b)")
h.contains("a quote in a link target is escaped", out, "href='https://example.com/a&#x27;b'")

out = render("README.md", "an ![a & b](https://example.com/i.png) image")
h.contains("an image is left out", out, "<p>an  image</p>")

out = render("README.md", "a [![ci](https://ci.example/b.svg)](https://ci.example/) badge")
h.contains("a badge is left out with its link", out, "<p>a  badge</p>")

out = render("README.md", "[![a](x.svg)](y)\n![b](z.svg)\n\ntext")
h.contains("a paragraph of badges leaves nothing behind", out, "<div class='markdown'><p>text</p></div>")

out = render("README.md", "```lua\nlocal x = 1 < 2\n```\nafter")
h.contains("a fenced block carries its language", out,
	"<pre><code data-lang='lua'>local x = 1 &lt; 2\n</code></pre>")
h.contains("text after the fence renders on", out, "<p>after</p>")

out = render("README.md", "~~~\n**not bold**\n~~~")
h.contains("no inline parsing happens inside a fence", out, "<code>**not bold**\n</code>")

out = render("README.md", "---")
h.contains("a rule of dashes renders a break", out, "<hr>")

out = render("README.md", "- - -")
h.contains("a spaced rule renders a break too", out, "<hr>")

out = render("README.md", "> quoted words")
h.contains("a quote renders as a blockquote", out, "<blockquote><p>quoted words</p></blockquote>")

out = render("README.md", "> > deep")
h.contains("quotes nest", out, "<blockquote><blockquote><p>deep</p></blockquote></blockquote>")

-- A hostile readme of stacked markers has to hit the depth ceiling instead
-- of the interpreter's stack.
out = render("README.md", string.rep("> ", 30) .. "x")
local _, quote_count = out:gsub("<blockquote>", "")
h.equals("quote nesting stops at the ceiling", quote_count, 24)
h.contains("the innermost text still renders", out, "x")

out = render("README.md", string.rep("*a", 200))
h.check("an emphasis bomb still renders something", #out > 0)

-- Trimming a run of spaces must stay linear, or one hostile line holds a
-- request for minutes. The lines below took minutes before, and the bound
-- leaves room for a slow host, where they take a few seconds now.
local started = os.clock()
render("README.md", "# a" .. string.rep(" ", 3000) .. "b")
render("README.md", string.rep("# a\n", 50000))
render("README.md", "| a | b |\n|---|---|\n| x" .. string.rep(" ", 40000) .. "y | z |")
h.check("a long run of spaces is trimmed quickly", os.clock() - started < 10)

out = render("README.md", "| a | b |\n| --- | --- |\n| 1 | 2 |")
h.contains("a pipe table renders its head", out, "<thead><tr><th>a</th><th>b</th></tr></thead>")
h.contains("a pipe table renders its body", out, "<tbody><tr><td>1</td><td>2</td></tr></tbody>")

out = render("README.md", "Pick one:\n| a | b |\n|---|---|\n| 1 | 2 |")
h.contains("a table cuts a paragraph short", out, "<p>Pick one:</p><table><thead><tr><th>a</th>")

out = render("README.md", "a | b in prose")
h.excludes("a pipe without a delimiter row stays prose", out, "<table")

out = render("README.md", "- first\n- second")
h.contains("dashes render an unordered list", out, "<ul><li>first</li><li>second</li></ul>")

out = render("README.md", "1. first\n2. second")
h.contains("numbers render an ordered list", out, "<ol><li>first</li><li>second</li></ol>")

out = render("README.md", "- one\n  wrapped\n- two")
h.contains("a wrapped item stays one item", out, "<ul><li>one\nwrapped</li><li>two</li></ul>")

out = render("README.md", "1. step\nlazy line\n2. next")
h.contains("an unindented line carries the item on", out, "<ol><li>step\nlazy line</li><li>next</li></ol>")

out = render("README.md", "- item\n---")
h.contains("a rule still ends the list", out, "<ul><li>item</li></ul><hr>")

out = render("README.md", "- plain\n1. numbered")
h.contains("a change of marker splits the list", out, "</ul><ol>")

out = render("README.md", "- a **bold** item")
h.contains("list items parse their text", out, "<li>a <strong>bold</strong> item</li>")

out = render("README.md", string.rep("a", 512 * 1024 + 1))
h.contains("an oversized readme renders as plain text", out, "<pre class='plaintext'>")

-- Man pages.

out = render("page.1", ".SH NAME")
h.contains("a section heading renders", out, "<div class='markdown manpage'><h2 id='name'>NAME</h2></div>")

out = render("page.man", '.SH "TWO WORDS"')
h.contains("a quoted heading argument is unquoted", out, "<h2 id='two-words'>TWO WORDS</h2>")

out = render("page.3", ".SS Details")
h.contains("a subsection renders one level down", out, "<h3 id='details'>Details</h3>")

out = render("page.1", ".B bold words\nplain after")
h.contains("the bold macro renders strong", out, "<p><strong>bold words</strong>\nplain after</p>")

out = render("page.1", "a \\fBbold\\fR c")
h.contains("font escapes carry across a run", out, "<p>a <strong>bold</strong> c</p>")

out = render("page.1", "x \\(em y \\- z")
h.contains("character escapes are translated", out, "<p>x - y - z</p>")

out = render("page.1", ".nf\ncode <x>\n.fi\nafter")
h.contains("a no fill block renders as code", out, "<pre><code>code &lt;x&gt;\n</code></pre>")
h.contains("filling resumes after it", out, "<p>after</p>")

out = render("page.1", '.\\" a comment\nvisible')
h.excludes("a roff comment is dropped", out, "comment")
h.contains("the line after it renders", out, "visible")

out = render("page.1", "first\n\nsecond")
h.contains("a blank line splits paragraphs", out, "<p>first</p><p>second</p>")

out = render("page.1", ".TH title 1\nbody")
h.excludes("the title macro renders nothing itself", out, "title 1")
h.contains("the body after it renders", out, "<p>body</p>")

h.finish()