diff --git a/meshchatx/src/backend/markdown_renderer.py b/meshchatx/src/backend/markdown_renderer.py index 7d50e75..7b0ecd4 100644 --- a/meshchatx/src/backend/markdown_renderer.py +++ b/meshchatx/src/backend/markdown_renderer.py @@ -70,12 +70,12 @@ class MarkdownRenderer: ) # Bold and Italic - text = re.sub(r"\*\*\*(.*?)\*\*\*", r"\1", text) - text = re.sub(r"\*\*(.*?)\*\*", r"\1", text) - text = re.sub(r"\*(?!\s)(.*?)(?\1", text) - text = re.sub(r"___(.*?)___", r"\1", text) - text = re.sub(r"__(.*?)__", r"\1", text) - text = re.sub(r"_(?!\s)(.*?)(?\1", text) + text = re.sub(r"\*\*\*(.+?)\*\*\*", r"\1", text) + text = re.sub(r"\*\*(.+?)\*\*", r"\1", text) + text = re.sub(r"\*(?!\s)(.+?)(?\1", text) + text = re.sub(r"___(.+?)___", r"\1", text) + text = re.sub(r"__(.+?)__", r"\1", text) + text = re.sub(r"_(?!\s)(.+?)(?\1", text) # Strikethrough text = re.sub(r"~~(.*?)~~", r"\1", text) diff --git a/tests/backend/test_property_based.py b/tests/backend/test_property_based.py index bfc5336..7d0963c 100644 --- a/tests/backend/test_property_based.py +++ b/tests/backend/test_property_based.py @@ -333,12 +333,18 @@ def test_markdown_renderer_xss_protection(text): assert "<script>" in result -@given(content=st.text()) +@given(content=st.text().filter(lambda x: x and "\n" not in x and "#" not in x)) def test_markdown_renderer_headers(content): - if content and "\n" not in content: - input_text = f"# {content}" - result = MarkdownRenderer.render(input_text) - assert "') + + # If the content doesn't contain markdown special chars, we can expect it to be there escaped + # This is a safer assertion for property-based testing + if not any(c in content for c in "*_~`[]()"): assert html.escape(content) in result