package render
import (
"strings"
"testing"
)
func TestMarkdownImageURL(t *testing.T) {
tests := []struct {
name, destination, markdownPath, rawBase, want string
}{
{"summary", "images/logo.png", "README.md", "raw/master", "raw/master/images/logo.png"},
{"blob", "images/logo.png", "README.md", "../../raw/master", "../../raw/master/images/logo.png"},
{"nested", "./images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/docs/images/logo.png"},
{"parent", "../images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/images/logo.png"},
{"root", "/images/logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/images/logo.png"},
{"commit", "logo.png", "docs/guide.md", "../../../raw/abc123", "../../../raw/abc123/docs/logo.png"},
{"escaping", "images/my%20logo%23%3F.png?v=1#preview", "README.md", "raw/master", "raw/master/images/my%20logo%23%3F.png?v=1#preview"},
{"traversal", "../../../logo.png", "docs/guide.md", "../../../raw/master", "../../../raw/master/logo.png"},
{"https", "https://example.com/logo.png", "README.md", "raw/master", "https://example.com/logo.png"},
{"protocol relative", "//example.com/logo.png", "README.md", "raw/master", "//example.com/logo.png"},
{"data", "data:image/png;base64,AAAA", "README.md", "raw/master", "data:image/png;base64,AAAA"},
{"fragment", "#logo", "README.md", "raw/master", "#logo"},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := markdownImageURL(tt.destination, tt.markdownPath, tt.rawBase); got != tt.want {
t.Fatalf("got %q, want %q", got, tt.want)
}
})
}
}
func TestRenderMarkdownImages(t *testing.T) {
src := []byte("\n\n![reference][logo]\n\n[logo]: ./local.png \"Title\"\n\n[link](../images/logo.png)\n\n\n\n)\n\n``\n")
html, err := renderMarkdownSafe(src, "docs/guide.md", "../../../raw/master", "../../../blob/master")
if err != nil {
t.Fatal(err)
}
for _, want := range []string{
`src="../../../raw/master/images/logo.png"`,
`src="../../../raw/master/docs/local.png"`,
`title="Title"`,
`href="../images/logo.png"`,
`src="https://example.com/logo.png"`,
``,
} {
if !strings.Contains(string(html), want) {
t.Errorf("missing %q in %s", want, html)
}
}
if strings.Contains(string(html), "javascript:") {
t.Errorf("unsafe image URL survived sanitization: %s", html)
}
}
func TestMarkdownLinkURL(t *testing.T) {
tests := []struct {
name, destination, markdownPath, blobBase, want string
}{
{"summary", "docs/guide.md", "README.md", "blob/master", "blob/master/docs/guide.md.html"},
{"blob", "guide.md", "README.md", "../../blob/master", "../../blob/master/guide.md.html"},
{"nested", "./intro.md", "docs/guide.md", "../../../blob/master", "../../../blob/master/docs/intro.md.html"},
{"parent", "../README.md#setup", "docs/guide.md", "../../../blob/master", "../../../blob/master/README.md.html#setup"},
{"root", "/README.md", "docs/guide.md", "../../../blob/master", "../../../blob/master/README.md.html"},
{"commit", "intro.md", "docs/guide.md", "../../../blob/abc123", "../../../blob/abc123/docs/intro.md.html"},
{"escaping", "my%20guide%23%3F.md?v=1#setup", "README.md", "blob/master", "blob/master/my%20guide%23%3F.md.html?v=1#setup"},
{"uppercase", "GUIDE.MD", "README.md", "blob/master", "blob/master/GUIDE.MD.html"},
{"traversal", "../../../guide.md", "docs/guide.md", "../../../blob/master", "../../../blob/master/guide.md.html"},
{"https", "https://example.com/guide.md", "README.md", "blob/master", "https://example.com/guide.md"},
{"protocol relative", "//example.com/guide.md", "README.md", "blob/master", "//example.com/guide.md"},
{"fragment", "#setup", "README.md", "blob/master", "#setup"},
{"query only", "?file=guide.md", "README.md", "blob/master", "?file=guide.md"},
{"non markdown", "image.png", "README.md", "blob/master", "image.png"},
{"already rendered", "guide.md.html", "README.md", "blob/master", "guide.md.html"},
{"invalid", "bad%ZZ.md", "README.md", "blob/master", "bad%ZZ.md"},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
if got := markdownLinkURL(tt.destination, tt.markdownPath, tt.blobBase); got != tt.want {
t.Fatalf("got %q, want %q", got, tt.want)
}
})
}
}
func TestRenderMarkdownLinks(t *testing.T) {
src := []byte("[inline](../README.md#setup)\n\n[reference][guide]\n\n[guide]: ./intro.md?v=1#heading \"Guide\"\n\n\n\n[external](https://example.com/guide.md)\n\n[anchor](#heading)\n\n[unsafe](javascript:alert(1))\n\n`[code](intro.md)`\n")
html, err := renderMarkdownSafe(src, "docs/guide.md", "../../../raw/master", "../../../blob/master")
if err != nil {
t.Fatal(err)
}
for _, want := range []string{
`href="../../../blob/master/README.md.html#setup"`,
`href="../../../blob/master/docs/intro.md.html?v=1#heading"`,
`title="Guide"`,
`src="../../../raw/master/docs/diagram.md"`,
`href="https://example.com/guide.md"`,
`href="#heading"`,
`[code](intro.md)`,
} {
if !strings.Contains(string(html), want) {
t.Errorf("missing %q in %s", want, html)
}
}
if strings.Contains(string(html), "javascript:") {
t.Errorf("unsafe link URL survived sanitization: %s", html)
}
}