penguin/flatgit

internal/render/markdown_test.go

raw · 2522 bytes

package render

import (
	"strings"
	"testing"
)

func TestMarkdownImageURL(t *testing.T) {
	tests := []struct {
		name, destination, markdownPath, rawBase, want string
	}{
		{"summary", "images/logo.png", "README.md", "raw/master", "raw/master/images/logo.png"},
		{"blob", "images/logo.png", "README.md", "../../raw/master", "../../raw/master/images/logo.png"},
		{"nested", "./images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/docs/images/logo.png"},
		{"parent", "../images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/images/logo.png"},
		{"root", "/images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/images/logo.png"},
		{"commit", "logo.png", "docs/guide.md", "../../../raw/abc123", "../../../raw/abc123/docs/logo.png"},
		{"escaping", "images/my%20logo%23%3F.png?v=1#preview", "README.md", "raw/master", "raw/master/images/my%20logo%23%3F.png?v=1#preview"},
		{"traversal", "../../../logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/logo.png"},
		{"https", "https://example.com/logo.png", "README.md", "raw/master", "https://example.com/logo.png"},
		{"protocol relative", "//example.com/logo.png", "README.md", "raw/master", "//example.com/logo.png"},
		{"data", "data:image/png;base64,AAAA", "README.md", "raw/master", "data:image/png;base64,AAAA"},
		{"fragment", "#logo", "README.md", "raw/master", "#logo"},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			if got := markdownImageURL(tt.destination, tt.markdownPath, tt.rawBase); got != tt.want {
				t.Fatalf("got %q, want %q", got, tt.want)
			}
		})
	}
}

func TestRenderMarkdownImages(t *testing.T) {
	src := []byte("![inline](../images/logo.png)\n\n![reference][logo]\n\n[logo]: ./local.png \"Title\"\n\n[link](../images/logo.png)\n\n![external](https://example.com/logo.png)\n\n![unsafe](javascript:alert(1))\n\n`![code](local.png)`\n")
	html, err := renderMarkdownSafe(src, "docs/guide.md", "../../../raw/master")
	if err != nil {
		t.Fatal(err)
	}
	for _, want := range []string{
		`src="../../../raw/master/images/logo.png"`,
		`src="../../../raw/master/docs/local.png"`,
		`title="Title"`,
		`href="../images/logo.png"`,
		`src="https://example.com/logo.png"`,
		`<code>![code](local.png)</code>`,
	} {
		if !strings.Contains(string(html), want) {
			t.Errorf("missing %q in %s", want, html)
		}
	}
	if strings.Contains(string(html), "javascript:") {
		t.Errorf("unsafe image URL survived sanitization: %s", html)
	}
}