text(' | Item | Price | |---|---| | Something | $ 472,78 | | Another entry | € 111 | | | | | Total | A lot |'); self::assertStringStartsWith('', $html); } public function testHeaderContainsId(): void { $sut = new Parsedown(); $html = $sut->text(' # Foo '); self::assertEquals('

Foo

', $html); } public function testHeaderContainsIdDoesNotDuplicate(): void { $sut = new Parsedown(); $html = $sut->text(' # Foo # Foo # Foo '); self::assertEquals('

Foo

', $html); } /** * Markdown image syntax must never emit an `` tag, otherwise mPDF * (server-side) or the browser (UI) would auto-fetch the remote URL. * * @see https://github.com/kimai/kimai/security/advisories/GHSA-pj8j-p4g4-4vw8 */ public function testMarkdownImageIsRewrittenAsLink(): void { $sut = new Parsedown(); $sut->setSafeMode(true); $sut->setMarkupEscaped(true); $html = $sut->text('![probe](http://attacker.example/p.png)'); self::assertStringNotContainsString('probe', $html); self::assertStringContainsString('target="_blank"', $html); self::assertStringContainsString('rel="noopener noreferrer"', $html); } public function testMarkdownImageWithoutAltUsesUrlAsLabel(): void { $sut = new Parsedown(); $sut->setSafeMode(true); $sut->setMarkupEscaped(true); $html = $sut->text('![](http://attacker.example/p.png)'); self::assertStringNotContainsString('http://attacker.example/p.png', $html); } public function testReferenceStyleImageIsRewrittenAsLink(): void { $sut = new Parsedown(); $sut->setSafeMode(true); $sut->setMarkupEscaped(true); $html = $sut->text("![probe][ref]\n\n[ref]: http://attacker.example/p.png"); self::assertStringNotContainsString('probe', $html); } public function testRawHtmlImageIsEscaped(): void { $sut = new Parsedown(); $sut->setSafeMode(true); $sut->setMarkupEscaped(true); $html = $sut->text('

'); self::assertStringNotContainsString('setSafeMode(true); $sut->setMarkupEscaped(true); $html = $sut->text('![x](javascript:alert(1))'); self::assertStringNotContainsString('