render_example_test.gno

 1package b58demo
 2
 3import (
 4	"strings"
 5	"testing"
 6
 7	"gno.land/p/nt/uassert/v0"
 8)
 9
10// ExampleRender pins the realm's Render output as a gno testable example.
11func ExampleRender() {
12	print(Render(""))
13	// Output:
14	// # Base58 (Bitcoin alphabet)
15	//
16	// Demo of the [`p/moul/x/daily/b58`](/p/moul/x/daily/b58/v0) library — base conversion from raw bytes (base-256) to base-58, using the Bitcoin alphabet (no `0`, `O`, `I`, `l`), pure byte-slice math, no `math/big`.
17	//
18	// ## Alphabet
19	//
20	// ```
21	// 123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz
22	// ```
23	//
24	// 58 characters, index 0…57.
25	//
26	// ## Examples
27	//
28	// | input (utf-8) | hex | Base58 |
29	// |---|---|---|
30	// | `(empty)` | `(empty)` | `` |
31	// | `hello world` | `68656c6c6f20776f726c64` | `StV1DL6CwTryKyV` |
32	// | `gno.land` | `676e6f2e6c616e64` | `JJR1f4BQc9H` |
33	// | `Bitcoin` | `426974636f696e` | `3WyEDWjcVB` |
34	//
35	// Leading zero bytes → leading `1`s:
36	//
37	// | bytes | Base58 |
38	// |---|---|
39	// | `[0x00]` | `1` |
40	// | `[0x00 0x00 0x00]` | `111` |
41	//
42	// ## Try it
43	//
44	// Append a hex string to the path to encode/round-trip it:
45	//
46	// - `/68656c6c6f` — the bytes for "hello"
47	// - `/00000000` — four zero bytes
48	// - `/deadbeef`
49}
50
51// The invalid-hex branch puts the visitor's raw URL path into a code span, and
52// ANY non-hex path reaches it. Building that span by hand let a backtick in the
53// path close it early, so the rest of the path rendered as markdown on a
54// gno.land page: a crafted link produced attacker-authored headings and links.
55// Measured through goldmark v1.8.2 with gnoweb's extension set.
56func TestInvalidHexPathCannotEscapeItsCodeSpan(t *testing.T) {
57	out := Render("/zz")
58	uassert.True(t, strings.Contains(out, "`zz`"),
59		"a plain invalid path is not shown verbatim in a code span")
60
61	// One backtick in the path must widen the fence, not close the span.
62	out = Render("/a`b")
63	uassert.True(t, strings.Contains(out, "``a`b``"),
64		"the fence does not outscan the caller's backtick, so the span closes early")
65
66	// The markdown that follows a closing backtick must stay inert.
67	out = Render("/x` and [CLICK](https://evil.example) `")
68	uassert.False(t, strings.Contains(out, "] and [CLICK]"),
69		"caller markdown escaped the code span")
70	uassert.True(t, strings.Contains(out, "is not a valid hex string"),
71		"the realm's own sentence did not survive")
72}