text(' | Item | Price | |---|---| | Something | $ 472,78 | | Another entry | € 111 | | | | | Total | A lot |'); self::assertStringStartsWith('', $html); } public function testHeaderIsNotConverted(): void { $sut = new ParsedownExtension(); $html = $sut->text(' # Foo '); self::assertEquals('

# Foo

', $html); } /** * Markdown image syntax must never emit an `` tag, otherwise mPDF * (server-side) or the browser (UI) would auto-fetch the remote URL. * * @see https://github.com/kimai/kimai/security/advisories/GHSA-pj8j-p4g4-4vw8 */ public function testMarkdownImageIsRewrittenAsLink(): void { $sut = new ParsedownExtension(); $sut->setSafeMode(true); $sut->setMarkupEscaped(true); $html = $sut->text('![probe](http://attacker.example/p.png)'); self::assertStringNotContainsString('probe', $html); } }