package render import ( "strings" "testing" ) func TestMarkdownImageURL(t *testing.T) { tests := []struct { name, destination, markdownPath, rawBase, want string }{ {"summary", "images/logo.png", "README.md", "raw/master", "raw/master/images/logo.png"}, {"blob", "images/logo.png", "README.md", "../../raw/master", "../../raw/master/images/logo.png"}, {"nested", "./images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/docs/images/logo.png"}, {"parent", "../images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/images/logo.png"}, {"root", "/images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/images/logo.png"}, {"commit", "logo.png", "docs/guide.md", "../../../raw/abc123", "../../../raw/abc123/docs/logo.png"}, {"escaping", "images/my%20logo%23%3F.png?v=1#preview", "README.md", "raw/master", "raw/master/images/my%20logo%23%3F.png?v=1#preview"}, {"traversal", "../../../logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/logo.png"}, {"https", "https://example.com/logo.png", "README.md", "raw/master", "https://example.com/logo.png"}, {"protocol relative", "//example.com/logo.png", "README.md", "raw/master", "//example.com/logo.png"}, {"data", "data:image/png;base64,AAAA", "README.md", "raw/master", "data:image/png;base64,AAAA"}, {"fragment", "#logo", "README.md", "raw/master", "#logo"}, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { if got := markdownImageURL(tt.destination, tt.markdownPath, tt.rawBase); got != tt.want { t.Fatalf("got %q, want %q", got, tt.want) } }) } } func TestRenderMarkdownImages(t *testing.T) { src := []byte("![inline](../images/logo.png)\n\n![reference][logo]\n\n[logo]: ./local.png \"Title\"\n\n[link](../images/logo.png)\n\n![external](https://example.com/logo.png)\n\n![unsafe](javascript:alert(1))\n\n`![code](local.png)`\n") html, err := renderMarkdownSafe(src, "docs/guide.md", "../../../raw/master") if err != nil { t.Fatal(err) } for _, want := range []string{ `src="../../../raw/master/images/logo.png"`, `src="../../../raw/master/docs/local.png"`, `title="Title"`, `href="../images/logo.png"`, `src="https://example.com/logo.png"`, `![code](local.png)`, } { if !strings.Contains(string(html), want) { t.Errorf("missing %q in %s", want, html) } } if strings.Contains(string(html), "javascript:") { t.Errorf("unsafe image URL survived sanitization: %s", html) } }