import mistune
def test_escape():
ret = mistune.markdown('
**foo**
', escape=True)
assert '>' in ret
ret = mistune.markdown('this **foo** is bold', escape=True)
assert '>' in ret
def test_linebreak():
ret = mistune.markdown('this **foo** \nis me')
assert '
' not in ret
ret = mistune.markdown('this **foo** \nis me', hard_wrap=True)
assert '
' in ret
def test_safe_links():
attack_vectors = (
# "standard" javascript pseudo protocol
('javascript:alert`1`', ''),
# bypass attempt
('jAvAsCrIpT:alert`1`', ''),
# bypass with newline
('javasc\nript:alert`1`', ''),
# javascript pseudo protocol with entities
('javascript:alert`1`', 'javascript:alert`1`'),
# javascript pseudo protocol with prefix (dangerous in Chrome)
('\x1Ajavascript:alert`1`', ''),
# vbscript-URI (dangerous in Internet Explorer)
('vbscript:msgbox', ''),
# breaking out of the attribute
('"<>', '"<>'),
)
for vector, expected in attack_vectors:
# image
assert 'src="%s"' % expected in mistune.markdown('![atk](%s)' % vector)
# link
assert 'href="%s"' % expected in mistune.markdown('[atk](%s)' % vector)
def test_skip_style():
ret = mistune.markdown(
'foo\n', skip_style=True
)
assert ret == 'foo
\n'
def test_use_xhtml():
ret = mistune.markdown('foo\n\n----\n\nbar')
assert '
' in ret
ret = mistune.markdown('foo\n\n----\n\nbar', use_xhtml=True)
assert '
' in ret
ret = mistune.markdown('foo \nbar', use_xhtml=True)
assert '
' in ret
ret = mistune.markdown('![foo](bar "title")', use_xhtml=True)
assert '' in ret
def test_parse_inline_html():
ret = mistune.markdown(
'**foo**
', parse_inline_html=True, escape=False
)
assert '' not in ret
ret = mistune.markdown(
'**foo**', parse_inline_html=True, escape=False
)
assert '' in ret
ret = mistune.markdown(
'**foo**', parse_inline_html=True, escape=False
)
assert '' in ret
ret = mistune.markdown(
'**foo**', parse_inline_html=True, escape=False
)
assert '' in ret
ret = mistune.markdown(
'http://lepture.com', parse_inline_html=True, escape=False
)
assert 'href' not in ret
def test_block_html():
ret = mistune.markdown(
'', escape=False
)
assert '' in ret
def test_parse_block_html():
ret = mistune.markdown(
'**foo**
', parse_block_html=True, escape=False
)
assert '' in ret
ret = mistune.markdown(
'**foo**
', parse_block_html=True, escape=False
)
assert '' in ret
ret = mistune.markdown(
'**foo**
', parse_block_html=True, escape=False
)
assert '' in ret
ret = mistune.markdown(
'**foo**', parse_block_html=True, escape=False
)
assert '' not in ret
def test_parse_nested_html():
ret = mistune.markdown(
'',
parse_block_html=True, escape=False
)
assert '