zz_escape_test.gno

 1package urlshort
 2
 3import (
 4	"strings"
 5	"testing"
 6
 7	"gno.land/p/nt/testutils/v0"
 8	"gno.land/p/nym-moultest123/md/v0"
 9	"gno.land/p/nt/uassert/v0"
10)
11
12// The note is escaped, and a target that could close its <autolink>, or is
13// not http(s), is refused when it is written.
14func TestNoteIsEscapedAndTargetChecked(cur realm, t *testing.T) {
15	testing.SetRealm(testing.NewUserRealm(testutils.TestAddress("escaper")))
16	Shorten(cross(cur), "esc", "https://ok.example", "[claim](https://evil.example)")
17	page := Render("esc")
18	uassert.False(t, strings.Contains(page, "[claim](https://evil.example)"), page)
19	uassert.AbortsContains(t, cur, "url must be http", func() { Shorten(cross(cur), "esc2", "https://a.example> [evil](https://b.example)", "") })
20	uassert.AbortsContains(t, cur, "url must be http", func() { Shorten(cross(cur), "esc3", "javascript:alert(1)", "") })
21}
22
23// A path that names nothing is echoed back on the not-found page. It is the
24// visitor's text, so a backtick in it must not close a code span and let a
25// link through.
26func TestNotFoundPathIsEscaped(t *testing.T) {
27	out := Render("x` [claim](https://evil.example) `")
28	// Still there, but inside a span md.InlineCode widened past its backticks.
29	uassert.True(t, strings.Contains(out, md.InlineCode("x` [claim](https://evil.example) `")), out)
30}