tamabox/internal/template/markdown_test.go

package template

import (
	"strings"
	"testing"
)

func TestMarkdownToHTML_Basic(t *testing.T) {
	cases := []struct {
		name string
		in   string
		want string // 必须包含
	}{
		{"bold", "**bold**", "<strong>bold</strong>"},
		{"italic", "*italic*", "<em>italic</em>"},
		{"link", "[baidu](https://baidu.com)", `href="https://baidu.com"`},
		{"list", "- item1\n- item2", "<li>item1</li>"},
		{"code", "`code`", "<code>code</code>"},
		{"newline", "line1\nline2", "<br>"},
		{"font-red", `<font color="red">文本</font>`, `<font color="red">文本</font>`},
		{"font-hex", `<font color="#ff0000">红</font>`, `<font color="#ff0000">红</font>`},
		{"font-rgb", `<font color="rgb(255,0,0)">红</font>`, `<font color="rgb(255,0,0)">红</font>`},
		{"font-mixed", `**粗体** 和 <font color="blue">蓝</font>`, `<font color="blue">蓝</font>`},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got := string(MarkdownToHTML(tc.in))
			if !strings.Contains(got, tc.want) {
				t.Errorf("MarkdownToHTML(%q) = %q, 期望包含 %q", tc.in, got, tc.want)
			}
		})
	}
}

func TestMarkdownToHTML_XSS(t *testing.T) {
	cases := []string{
		`&lt;script&gt;alert(1)&lt;/script&gt;`,
		`&amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;`,
		`<script>alert(1)</script>`,
		`<img src=x onerror=alert(1)>`,
		`[x](javascript:alert(1))`,
		`<a href="javascript:alert(1)">x</a>`,
		`<iframe src="https://evil.com"></iframe>`,
		"<svg onload=alert(1)>",
		`<div onclick="alert(1)">x</div>`,
		`<style>body{display:none}</style>`,
	}
	for _, in := range cases {
		got := string(MarkdownToHTML(in))
		if strings.Contains(got, "<script") || strings.Contains(got, " onerror") ||
			strings.Contains(got, " onclick") || strings.Contains(got, " onload") ||
			strings.Contains(got, "<iframe") || strings.Contains(got, "javascript:") ||
			strings.Contains(got, "<style") || strings.Contains(got, "<svg") {
			t.Errorf("XSS 防护失败: 输入 %q 输出 %q", in, got)
		}
	}
}

// TestMarkdownToHTML_FontColorInjection font 的 color 属性只放行合法颜色值，
// 注入尝试必须被丢弃（标签保留但 color 属性被剥离，且不产生新属性）。
func TestMarkdownToHTML_FontColorInjection(t *testing.T) {
	cases := []struct {
		name string
		in   string
		want string // 输出必须包含（剥离后仅剩文本）
	}{
		{"css-inject", `<font color="red;position:fixed">x</font>`, "x"},
		{"quote-inject", `<font color="red" onclick="alert(1)">x</font>`, "x"},
		{"url-inject", `<font color="url(javascript:alert(1))">x</font>`, "x"},
		{"onattr-inject", `<font color="x" style="background:url(javascript:1)">x</font>`, "x"},
		{"long-value", `<font color="` + strings.Repeat("a", 50) + `">x</font>`, "x"},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got := string(MarkdownToHTML(tc.in))
			if !strings.Contains(got, tc.want) {
				t.Errorf("输出 %q 应包含 %q", got, tc.want)
			}
			// 注入的 color 值不得出现
			for _, evil := range []string{";", "position:", "onclick", "javascript:", "<font color=\"red\" onclick", "<font color=\"x\" style"} {
				if strings.Contains(got, evil) {
					t.Errorf("注入残留: %q 包含 %q", got, evil)
				}
			}
		})
	}
}

func TestMarkdownToHTML_Empty(t *testing.T) {
	if got := string(MarkdownToHTML("")); got != "" {
		t.Errorf("空输入应输出空串, got %q", got)
	}
}

func TestMarkdownToPlainText(t *testing.T) {
	cases := []struct {
		name string
		in   string
		want string // 必须包含（忽略换行折叠）
	}{
		{"plain", "你好世界", "你好世界"},
		{"bold", "**粗体**", "粗体"},
		{"font", `<font color="red">红字</font>`, "红字"},
		{"link", "[百度](https://baidu.com)", "百度"},
		{"code", "`code`", "code"},
		{"list", "- 第一项\n- 第二项", "第一项"},
		{"block", "# 标题\n内容", "标题"},
		{"mixed", "问题：**重要** 详情 <font color=\"blue\">蓝</font>", "重要"},
		{"empty", "", ""},
		// 危险标签被剥离：script 的内容是纯文本（绘制无风险），img 自闭合无文本则输出空
		{"xss-script", "<script>alert(1)</script>", "alert(1)"},
		{"xss-img", `<img src=x onerror=alert(1)>`, ""},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got := strings.Join(strings.Fields(MarkdownToPlainText(tc.in)), " ")
			if tc.want == "" {
				if got != "" {
					t.Errorf("MarkdownToPlainText(%q) = %q, 期望空", tc.in, got)
				}
				return
			}
			if !strings.Contains(got, tc.want) {
				t.Errorf("MarkdownToPlainText(%q) = %q, 期望包含 %q", tc.in, got, tc.want)
			}
			// 输出不得残留任何标签（< 必须被剥离）
			if strings.Contains(got, "<") {
				t.Errorf("MarkdownToPlainText(%q) = %q, 不应包含标签字符", tc.in, got)
			}
		})
	}
}

// TestSafeURL 是 P2-1 的回归测试：markdown 链接白名单必须拒绝协议相对 URL
// （//evil.com 等），否则会被误判为站内相对路径而渲染成指向外站的钓鱼 / 外链埋点链接。
// 同时验证 javascript:/data:/ftp: 等危险协议与大小写变体均被拒绝，http/https/mailto
// 与站内相对路径被放行。
func TestSafeURL(t *testing.T) {
	allow := []string{
		"https://example.com",
		"http://example.com",
		"HTTPS://EXAMPLE.COM", // 大小写不敏感
		"mailto:[email protected]",
		"/path/to/page",
		"./relative",
		"../up",
		"#fragment",
	}
	for _, u := range allow {
		if !safeURL(u) {
			t.Errorf("safeURL(%q) = false, 期望放行", u)
		}
	}

	deny := []string{
		"//evil.com",          // 协议相对 URL（核心回归点）
		`\\evil.com`,          // 反斜杠变体
		`/\evil.com`,          // 反斜杠变体
		"javascript:alert(1)", // 危险协议
		"JavaScript:alert(1)", // 大小写变体
		"data:text/html,<script>",
		"ftp://example.com",
		"", // 空串
	}
	for _, u := range deny {
		if safeURL(u) {
			t.Errorf("safeURL(%q) = true, 期望拒绝", u)
		}
	}
}