summaryrefslogtreecommitdiff
path: root/HutchTests
diff options
context:
space:
mode:
authorChristian Cleberg <[email protected]>2026-07-15 19:22:12 -0500
committerChristian Cleberg <[email protected]>2026-07-15 19:22:12 -0500
commit63d0491b161457913c938d620dc1f26f29c798a9 (patch)
treeb7f0012e318b9c3eb2d4839b01c977119f6e393e /HutchTests
parent4346adc50f01be7f7322249d32745d119c757ff2 (diff)
downloadhutch-63d0491b161457913c938d620dc1f26f29c798a9.tar.gz
hutch-63d0491b161457913c938d620dc1f26f29c798a9.tar.bz2
hutch-63d0491b161457913c938d620dc1f26f29c798a9.zip
test: assert image URLs are not double-escaped
markdownImageQueryStringPreservesAmpersands rejected any "amp;metric" in the rendered HTML, but `&amp;` is the correct encoding for `&` in an attribute value and is what a browser needs to request a literal `&`. The assertion conflated the URL with its HTML encoding. Target the real failure mode instead: double-escaping, which would send "&amp;" through as part of the query string and break badge images.
Diffstat (limited to 'HutchTests')
-rw-r--r--HutchTests/ReadmeViewTests.swift5
1 files changed, 4 insertions, 1 deletions
diff --git a/HutchTests/ReadmeViewTests.swift b/HutchTests/ReadmeViewTests.swift
index 3b9d80b..08e602d 100644
--- a/HutchTests/ReadmeViewTests.swift
+++ b/HutchTests/ReadmeViewTests.swift
@@ -179,8 +179,11 @@ struct MarkdownRenderingTests {
func markdownImageQueryStringPreservesAmpersands() {
let html = processInline("![badge](https://sonarcloud.io/api/project_badges/measure?project=ccleberg_Hutch&metric=security_rating)")
+ // `&amp;` is the correct encoding for `&` in an attribute value, so the
+ // failure mode to guard against is double-escaping, which would make the
+ // browser request a literal "&amp;" in the query string.
#expect(html.contains("metric=security_rating"))
- #expect(!html.contains("amp;metric"))
+ #expect(!html.contains("&amp;amp;"))
#expect(html.contains("<img"))
}