# SPDX-License-Identifier: 0BSD import time import unittest from meshchatx.src.backend.markdown_renderer import MarkdownRenderer class TestMarkdownRenderer(unittest.TestCase): def test_basic_render(self): self.assertEqual(MarkdownRenderer.render(""), "") self.assertIn("Bold", MarkdownRenderer.render("**Bold**")) self.assertIn("Italic", MarkdownRenderer.render("*Italic*")) def test_links(self): rendered = MarkdownRenderer.render("[Google](https://google.com)") self.assertIn('href="https://google.com"', rendered) self.assertIn("Google", rendered) def test_code_blocks(self): code = "```python\nprint('hello')\n```" rendered = MarkdownRenderer.render(code) self.assertIn("", rendered) self.assertIn("strike", rendered) def test_paragraphs(self): md = "Para 1\n\nPara 2" rendered = MarkdownRenderer.render(md) self.assertIn("alert(1)", "", '', "", ] for s in cases: r = MarkdownRenderer.render(s) self.assertNotIn("", r, msg=s) self.assertIn("<", r, msg=s) def test_xss_event_handlers(self): cases = [ '', '', 'x', '', ] for s in cases: r = MarkdownRenderer.render(s) self.assertNotIn("alert(1))") self.assertNotIn("data:", r) self.assertIn('href="#"', r) def test_xss_link_href_vbscript(self): r = MarkdownRenderer.render("[click](vbscript:msgbox(1))") self.assertNotIn("vbscript:", r) self.assertIn('href="#"', r) def test_protocol_relative_link_href_neutralized(self): r = MarkdownRenderer.render("[phish](//evil.example/phish)") self.assertNotIn("//evil.example", r) self.assertNotIn('href="//', r) self.assertIn('href="#"', r) def test_unc_link_href_neutralized(self): md = "[click](" + "\\\\\\\\evil.example\\\\share" + ")" r = MarkdownRenderer.render(md) self.assertIn('href="#"', r) def test_protocol_relative_image_src_neutralized(self): r = MarkdownRenderer.render("![x](//evil.example/i)") self.assertNotIn("//evil.example", r) def test_safe_links_preserved(self): r = MarkdownRenderer.render("[link](https://example.com/path)") self.assertIn('href="https://example.com/path"', r) r = MarkdownRenderer.render("[link](/relative)") self.assertIn('href="/relative"', r) r = MarkdownRenderer.render("[link](#anchor)") self.assertIn('href="#anchor"', r) def test_redos_safe_repeated_markers(self): t0 = time.perf_counter() MarkdownRenderer.render("*" * 8000) MarkdownRenderer.render("#" * 8000) MarkdownRenderer.render("`" * 8000) MarkdownRenderer.render("[](" * 2000 + "x" * 2000 + ")" * 2000) elapsed = time.perf_counter() - t0 self.assertLess(elapsed, 2.0, "ReDoS or excessive backtracking suspected") def test_malformed_unclosed_markdown(self): cases = [ "**bold no close", "```\ncode no close", "*italic", "`code", "___under", "[unclosed link](url", "![unclosed img](src", ] for s in cases: r = MarkdownRenderer.render(s) self.assertIsInstance(r, str) self.assertNotIn("