diff options
| author | Christian Cleberg <[email protected]> | 2026-07-15 19:22:12 -0500 |
|---|---|---|
| committer | Christian Cleberg <[email protected]> | 2026-07-15 19:22:12 -0500 |
| commit | 63d0491b161457913c938d620dc1f26f29c798a9 (patch) | |
| tree | b7f0012e318b9c3eb2d4839b01c977119f6e393e /HutchTests | |
| parent | 4346adc50f01be7f7322249d32745d119c757ff2 (diff) | |
| download | hutch-63d0491b161457913c938d620dc1f26f29c798a9.tar.gz hutch-63d0491b161457913c938d620dc1f26f29c798a9.tar.bz2 hutch-63d0491b161457913c938d620dc1f26f29c798a9.zip | |
test: assert image URLs are not double-escaped
markdownImageQueryStringPreservesAmpersands rejected any "amp;metric" in the
rendered HTML, but `&` is the correct encoding for `&` in an attribute
value and is what a browser needs to request a literal `&`. The assertion
conflated the URL with its HTML encoding.
Target the real failure mode instead: double-escaping, which would send
"&" through as part of the query string and break badge images.
Diffstat (limited to 'HutchTests')
| -rw-r--r-- | HutchTests/ReadmeViewTests.swift | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/HutchTests/ReadmeViewTests.swift b/HutchTests/ReadmeViewTests.swift index 3b9d80b..08e602d 100644 --- a/HutchTests/ReadmeViewTests.swift +++ b/HutchTests/ReadmeViewTests.swift @@ -179,8 +179,11 @@ struct MarkdownRenderingTests { func markdownImageQueryStringPreservesAmpersands() { let html = processInline("") + // `&` is the correct encoding for `&` in an attribute value, so the + // failure mode to guard against is double-escaping, which would make the + // browser request a literal "&" in the query string. #expect(html.contains("metric=security_rating")) - #expect(!html.contains("amp;metric")) + #expect(!html.contains("&amp;")) #expect(html.contains("<img")) } |
