50 lines
1.4 KiB
Go
50 lines
1.4 KiB
Go
package renderkit
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestMarkdownDropsRawHTMLAndUnsafeLinks(t *testing.T) {
|
|
out := Markdown("hi <script>alert(1)</script> <img src=x onerror=alert(1)> [x](javascript:alert(1))\n\n<div onclick=\"x()\">boom</div>")
|
|
for _, bad := range []string{"<script", "<img", "onerror", "onclick", `href="javascript:`} {
|
|
if strings.Contains(out, bad) {
|
|
t.Fatalf("output contains %q:\n%s", bad, out)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestMarkdownKeepsCodeAndFormatting(t *testing.T) {
|
|
out := Markdown("**bold**\n\n```go\nx := \"<div>\" + `a`\n```\n\n`<b>`")
|
|
for _, want := range []string{"<strong>bold</strong>", "code-block", "copy-btn", "<div>", "<b>"} {
|
|
if !strings.Contains(out, want) {
|
|
t.Fatalf("missing %q in:\n%s", want, out)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestPlainStreamEscapes(t *testing.T) {
|
|
if got := PlainStream("<b>a</b>\nb"); got != "<b>a</b><br>b" {
|
|
t.Fatal(got)
|
|
}
|
|
}
|
|
|
|
// Regression: gomarkdown's Parser panics if reused, which used to make every
|
|
// reply after the first fail. Also exercised concurrently for the race detector.
|
|
func TestMarkdownIsReusableAndConcurrencySafe(t *testing.T) {
|
|
done := make(chan struct{})
|
|
for i := 0; i < 8; i++ {
|
|
go func() {
|
|
defer func() { done <- struct{}{} }()
|
|
for j := 0; j < 20; j++ {
|
|
if out := Markdown("# title\n\ntext"); !strings.Contains(out, "<h1") {
|
|
t.Error(out)
|
|
}
|
|
}
|
|
}()
|
|
}
|
|
for i := 0; i < 8; i++ {
|
|
<-done
|
|
}
|
|
}
|