diff options
Diffstat (limited to 'internal/markdown')
| -rw-r--r-- | internal/markdown/render_test.go | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/internal/markdown/render_test.go b/internal/markdown/render_test.go index 7240afc..6bc7e48 100644 --- a/internal/markdown/render_test.go +++ b/internal/markdown/render_test.go @@ -6,13 +6,13 @@ import ( ) func TestRenderSanitizes(t *testing.T) { - out := Render("# Hi\n\n**bold** <script>alert(1)</script> <a href=\"javascript:alert(1)\">x</a> <img src=\"/media/abc\" onerror=\"x()\">") + out := Render("# Hi\n\n**bold** <script>alert(1)</script> <a href=\"javascript:alert(1)\">x</a> <img src=\"/media/abc\" onerror=\"x()\"> [notes.pdf](/media/abc)") for _, bad := range []string{"<script", "javascript:", "onerror"} { if strings.Contains(out, bad) { t.Errorf("output contains %q: %s", bad, out) } } - for _, good := range []string{"<h1", "<strong>bold</strong>", `<img src="/media/abc"`} { + for _, good := range []string{"<h1", "<strong>bold</strong>", `<img src="/media/abc"`, `<a href="/media/abc"`} { if !strings.Contains(out, good) { t.Errorf("output missing %q: %s", good, out) } |