summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLukas Fleischer <lfleischer@archlinux.org>2017-04-23 21:20:37 +0200
committerLukas Fleischer <lfleischer@archlinux.org>2017-04-24 17:41:35 +0200
commit482bd10a8bf4906e79fa6e056b94dc90e3a74901 (patch)
tree51fb0bf0dcf514ebdd0e17e33bffb3a7d303c0ae
parentbb623fc545f0e0187cc9b32386c383b732bcc9ae (diff)
downloadaur-482bd10a8bf4906e79fa6e056b94dc90e3a74901.tar.gz
aur-482bd10a8bf4906e79fa6e056b94dc90e3a74901.tar.xz
t2600: Test Markdown and HTML sanitizing
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
-rwxr-xr-xtest/t2600-rendercomment.sh42
1 files changed, 42 insertions, 0 deletions
diff --git a/test/t2600-rendercomment.sh b/test/t2600-rendercomment.sh
index 6db9467d..8da15291 100755
--- a/test/t2600-rendercomment.sh
+++ b/test/t2600-rendercomment.sh
@@ -21,4 +21,46 @@ test_expect_success 'Test comment rendering.' '
test_cmp actual expected
'
+test_expect_success 'Test Markdown conversion.' '
+ cat <<-EOD | sqlite3 aur.db &&
+ INSERT INTO PackageComments (ID, PackageBaseID, Comments, RenderedComment) VALUES (2, 1, "*Hello* [world](https://www.archlinux.org/)!", "");
+ EOD
+ "$RENDERCOMMENT" 2 &&
+ cat <<-EOD >expected &&
+ <p><em>Hello</em> <a href="https://www.archlinux.org/">world</a>!</p>
+ EOD
+ cat <<-EOD | sqlite3 aur.db >actual &&
+ SELECT RenderedComment FROM PackageComments WHERE ID = 2;
+ EOD
+ test_cmp actual expected
+'
+
+test_expect_success 'Test HTML sanitizing.' '
+ cat <<-EOD | sqlite3 aur.db &&
+ INSERT INTO PackageComments (ID, PackageBaseID, Comments, RenderedComment) VALUES (3, 1, "<script>alert(""XSS!"");</script>", "");
+ EOD
+ "$RENDERCOMMENT" 3 &&
+ cat <<-EOD >expected &&
+ &lt;script&gt;alert("XSS!");&lt;/script&gt;
+ EOD
+ cat <<-EOD | sqlite3 aur.db >actual &&
+ SELECT RenderedComment FROM PackageComments WHERE ID = 3;
+ EOD
+ test_cmp actual expected
+'
+
+test_expect_success 'Test link conversion.' '
+ cat <<-EOD | sqlite3 aur.db &&
+ INSERT INTO PackageComments (ID, PackageBaseID, Comments, RenderedComment) VALUES (4, 1, "Visit https://www.archlinux.org/.", "");
+ EOD
+ "$RENDERCOMMENT" 4 &&
+ cat <<-EOD >expected &&
+ <p>Visit <a href="https://www.archlinux.org/">https://www.archlinux.org/</a>.</p>
+ EOD
+ cat <<-EOD | sqlite3 aur.db >actual &&
+ SELECT RenderedComment FROM PackageComments WHERE ID = 4;
+ EOD
+ test_cmp actual expected
+'
+
test_done