Andrew S Erwin
4e421f6ea2
release gate / check (push) Failing after 6m43s
High severity: - wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup - bucket public rate limits on effective client IP, add per-bookmark budget, and forward the signed browser identity from the share page - disable first-run bootstrap in server deployments and document seeding - serialize last-admin demotion in one advisory-locked transaction Medium/low: - cap and batch share recipient inserts - add a shared outbound budget for preview/CardDAV/IMAP/signal work - pin CardDAV dials to 443 and bound IMAP logout - fix rightward kanban column drags and normalize cards on column delete - classify backend outages in auth guards, add request timeouts and an error boundary, remove the dead login route, surface throttling - enforce pinned/unpinned page reorder grouping server-side - avoid preview work for stale bookmark versions; drop duplicate dialog fetch - sequence-guard collection/tag/calendar/quick-find loads - validate property config and fix MULTI_SELECT/DATE filter inputs - document index maintenance; apply same-origin check to sign-out - trim signup names, unique shared dates and kanban keys (migration 010), reset reference cache on identity changes, hide OIDC issuer, return 413 for oversized direct bodies, escape Markdown link destinations - remove dead template files and duplicate test helper Verified with go build/vet, full PostgreSQL race suite, db convergence, tsc, both ESLint configs and a Next production build.
28 lines
678 B
Go
28 lines
678 B
Go
package markdown
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/andrew/go-computer/internal/db"
|
|
)
|
|
|
|
// Review L-11: link destinations are wrapped and escaped so parentheses or
|
|
// angle brackets in a bookmark URL cannot terminate or extend the link.
|
|
func TestPageDocumentEscapesLinkDestinations(t *testing.T) {
|
|
out := PageDocument(db.Object{
|
|
"title": "Links",
|
|
"content": "",
|
|
"bookmarks": []any{
|
|
map[string]any{"bookmark": map[string]any{
|
|
"title": "Odd",
|
|
"url": "https://example.com/a(b)?x=<y>",
|
|
}},
|
|
},
|
|
})
|
|
want := "[Odd](<https://example.com/a(b)?x=%3Cy%3E>)"
|
|
if !strings.Contains(out, want) {
|
|
t.Fatalf("link destination not escaped:\n%s", out)
|
|
}
|
|
}
|