import mistune def test_escape(): ret = mistune.markdown('
**foo**
', escape=True) assert '>' in ret ret = mistune.markdown('this **foo** is bold', escape=True) assert '>' in ret def test_linebreak(): ret = mistune.markdown('this **foo** \nis me') assert '
' not in ret ret = mistune.markdown('this **foo** \nis me', hard_wrap=True) assert '
' in ret def test_safe_links(): attack_vectors = ( # "standard" javascript pseudo protocol ('javascript:alert`1`', ''), # bypass attempt ('jAvAsCrIpT:alert`1`', ''), # bypass with newline ('javasc\nript:alert`1`', ''), # javascript pseudo protocol with entities ('javascript:alert`1`', 'javascript&colon;alert`1`'), # javascript pseudo protocol with prefix (dangerous in Chrome) ('\x1Ajavascript:alert`1`', ''), # vbscript-URI (dangerous in Internet Explorer) ('vbscript:msgbox', ''), # breaking out of the attribute ('"<>', '"<>'), ) for vector, expected in attack_vectors: # image assert 'src="%s"' % expected in mistune.markdown('![atk](%s)' % vector) # link assert 'href="%s"' % expected in mistune.markdown('[atk](%s)' % vector) def test_skip_style(): ret = mistune.markdown( 'foo\n', skip_style=True ) assert ret == '

foo

\n' def test_use_xhtml(): ret = mistune.markdown('foo\n\n----\n\nbar') assert '
' in ret ret = mistune.markdown('foo\n\n----\n\nbar', use_xhtml=True) assert '
' in ret ret = mistune.markdown('foo \nbar', use_xhtml=True) assert '
' in ret ret = mistune.markdown('![foo](bar "title")', use_xhtml=True) assert 'foo' in ret def test_parse_inline_html(): ret = mistune.markdown( '
**foo**
', parse_inline_html=True, escape=False ) assert '' not in ret ret = mistune.markdown( '**foo**', parse_inline_html=True, escape=False ) assert '' in ret ret = mistune.markdown( '**foo**', parse_inline_html=True, escape=False ) assert '' in ret ret = mistune.markdown( '**foo**', parse_inline_html=True, escape=False ) assert '' in ret ret = mistune.markdown( 'http://lepture.com', parse_inline_html=True, escape=False ) assert 'href' not in ret def test_block_html(): ret = mistune.markdown( '
', escape=False ) assert '
' in ret def test_parse_block_html(): ret = mistune.markdown( '
**foo**
', parse_block_html=True, escape=False ) assert '
' in ret ret = mistune.markdown( '
**foo**
', parse_block_html=True, escape=False ) assert '
' in ret ret = mistune.markdown( '
**foo**
', parse_block_html=True, escape=False ) assert '
' in ret ret = mistune.markdown( '**foo**', parse_block_html=True, escape=False ) assert '' not in ret def test_parse_nested_html(): ret = mistune.markdown( '', parse_block_html=True, escape=False ) assert '
' in ret assert '' not in ret ret = mistune.markdown( '', parse_block_html=True, parse_inline_html=True, escape=False ) assert '
' in ret def test_trigger_more_cases(): markdown = mistune.Markdown( inline=mistune.InlineLexer, block=mistune.BlockLexer, skip_html=True ) ret = markdown.render('foo[^foo]\n\n[^foo]: foo\n\n[^foo]: bar\n') assert 'bar' not in ret def test_not_escape_block_tags(): text = '

heading

text' assert text in mistune.markdown(text, escape=False) def test_not_escape_inline_tags(): text = '
' assert text in mistune.markdown(text, escape=False) # space between = text = 'test' assert text in mistune.markdown(text, escape=False) def test_hard_wrap_renderer(): text = 'foo\nnewline' renderer = mistune.Renderer(hard_wrap=True) func = mistune.Markdown(renderer=renderer) assert '
' in func(text)