26 lines
651 B
Python
26 lines
651 B
Python
import json
|
|
import subprocess
|
|
from pathlib import Path
|
|
|
|
|
|
RENDERER = Path(__file__).parent.parent / "frontend" / "markdown.js"
|
|
|
|
|
|
def test_markdown_renderer_escapes_raw_html_before_rendering_heading():
|
|
payload = "# <img src=x onerror=alert(document.domain)>"
|
|
script = (
|
|
f"const render = require({json.dumps(str(RENDERER))});"
|
|
f"process.stdout.write(render({json.dumps(payload)}));"
|
|
)
|
|
|
|
result = subprocess.run(
|
|
["node", "-e", script],
|
|
check=True,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
|
|
assert result.stdout == (
|
|
"<h1><img src=x onerror=alert(document.domain)></h1>"
|
|
)
|