zz_escape_test.gno

 1package blog
 2
 3import (
 4	"strings"
 5	"testing"
 6
 7	"gno.land/p/nt/testutils/v0"
 8	"gno.land/p/moul/md/v0"
 9	"gno.land/p/nt/uassert/v0"
10)
11
12// Anyone may publish, so a title or a body is the caller's text and must not
13// become live markdown on the realm's own pages.
14func TestTitleAndBodyAreEscaped(cur realm, t *testing.T) {
15	testing.SetRealm(testing.NewUserRealm(testutils.TestAddress("escaper")))
16	id := Publish(cross(cur), "[claim](https://evil.example)", "line one\n[claim](https://evil.example)")
17	uassert.False(t, strings.Contains(Render(""), "[claim](https://evil.example)"), Render(""))
18	page := Render("/" + itoaTest(id))
19	uassert.False(t, strings.Contains(page, "[claim](https://evil.example)"), page)
20}
21
22// A path that names nothing is echoed back on the not-found page. It is the
23// visitor's text, so a backtick in it must not close a code span and let a
24// link through.
25func TestNotFoundPathIsEscaped(t *testing.T) {
26	out := Render("/x` [claim](https://evil.example) `")
27	// Still there, but inside a span md.InlineCode widened past its backticks.
28	uassert.True(t, strings.Contains(out, md.InlineCode("/x` [claim](https://evil.example) `")), out)
29}