hyper-note / test / unit / markdown.test.js

import test from 'brittle'
import { renderMarkdown } from '../../lib/markdown.js'

test('renderMarkdown - javascript: link scheme is neutralized', async (t) => {
  const html = renderMarkdown('[click me](javascript:alert(document.cookie))')
  t.absent(html.toLowerCase().includes('javascript:'), 'no javascript: scheme survives')
  t.ok(html.includes('<a href="">click me</a>'), 'href emptied by safeUrl, label preserved')
})

test('renderMarkdown - data:/vbscript: link schemes are neutralized', async (t) => {
  t.absent(renderMarkdown('[x](data:text/html,<script>1</script>)').toLowerCase().includes('data:'), 'data: blocked')
  t.absent(renderMarkdown('[x](vbscript:msgbox)').toLowerCase().includes('vbscript:'), 'vbscript: blocked')
})

test('renderMarkdown - normal https link is preserved', async (t) => {
  const html = renderMarkdown('see [example](https://example.com/p)')
  t.ok(html.includes('<a href="https://example.com/p">example</a>'), 'safe http(s) link intact')
})

test('renderMarkdown - raw <video> event-handler attributes are stripped', async (t) => {
  const html = renderMarkdown('<video onloadstart="alert(1)" onerror="alert(2)"><source src="/api/x.mp4"></video>')
  t.absent(html.includes('onloadstart'), 'onloadstart attribute dropped')
  t.absent(html.includes('onerror'), 'onerror attribute dropped')
  t.absent(html.toLowerCase().includes('alert'), 'no inline JS survives')
  t.ok(html.includes('<source src="/api/x.mp4">'), 'legitimate source URL preserved')
  t.ok(html.includes('<video controls'), 'clean <video controls> emitted')
})

test('renderMarkdown - raw <video> with javascript: source is dropped', async (t) => {
  const html = renderMarkdown('<video><source src="javascript:alert(1)"></video>')
  t.absent(html.toLowerCase().includes('javascript:'), 'malicious source filtered by safeUrl')
})

test('renderMarkdown - markdown image still renders safely', async (t) => {
  const html = renderMarkdown('![a picture](/api/notebooks/x/media/abc.png)')
  t.ok(html.includes('<img'), 'image rendered')
  t.ok(html.includes('src="/api/notebooks/x/media/abc.png"'), 'image src preserved')
})