make sure that markdown uses safe mode (#2961)

2021-11-19 23:07:27 +01:00
parent 9470699798
commit 76e09447c8
4 changed files with 39 additions and 4 deletions
--- a/tests/Utils/MarkdownTest.php
+++ b/tests/Utils/MarkdownTest.php
@@ -81,6 +81,24 @@ EOT;
 ## test
 ### test
 # test
+EOT;
+        $this->assertEquals($html, $sut->toHtml($markdown));
+    }
+
+    public function testLinksAreSanitized()
+    {
+        $sut = new Markdown();
+
+        $html = <<<'EOT'
+<p><a href="javascript%3Aalert(`XSS`)">XSS</a><br />
+<a href="javascript%3Aalert(&quot;XSS&quot;)">XSS</a><br />
+<a href="javascript%3Aalert(&#039;XSS&#039;)">XSS</a></p>
+EOT;
+
+        $markdown = <<<EOT
+[XSS](javascript:alert(`XSS`))
+[XSS](javascript:alert("XSS"))
+[XSS](javascript:alert('XSS'))
 EOT;
        $this->assertEquals($html, $sut->toHtml($markdown));
    }