Alec Perkins
99f810d043
- Signed-out visitors get the same login redirect for missing and private projects, so the redirect no longer reveals private ones. - Production refuses the console email backend; sign-in codes must never reach the logs. - Database cache shared by all workers for allauth rate limits; invite sending throttled per sender and per recipient. - Email invite links are claimed on first use and the token rotated, so a token copied from request logs is worthless. - allauth password URLs removed; adding an email requires a fresh code and notifies existing addresses. - Markdown drops remote images until uploads exist. - Project and org slugs lowercased; only superusers can grant staff status or permissions in the admin. - Container runs as a non-root user; CI actions pinned to commits. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
41 lines
1.4 KiB
Python
41 lines
1.4 KiB
Python
from intent.features.diff import line_diff
|
|
from intent.markdown import render
|
|
|
|
|
|
def test_blocks_carry_source_lines():
|
|
html = render("Para one\ncontinues.\n\n- a\n- b\n")
|
|
assert '<p data-source-lines="1-2">' in html
|
|
assert '<li data-source-lines="4-4">' in html
|
|
|
|
|
|
def test_headings_shift_down_one_level():
|
|
html = render("# Top\n\n###### Deepest\n")
|
|
assert "<h2" in html and "<h1" not in html
|
|
assert "<h6" in html
|
|
|
|
|
|
def test_raw_html_and_script_links_are_neutralised():
|
|
html = render("<script>alert(1)</script>\n\n[x](javascript:alert(1)) <img src=x onerror=y>")
|
|
assert "<script" not in html
|
|
assert "javascript:" not in html.replace("[x](javascript:alert(1))", "")
|
|
assert "onerror" not in html.replace("onerror=y>", "")
|
|
|
|
|
|
def test_remote_images_are_dropped():
|
|
assert "<img" not in render("")
|
|
|
|
|
|
def test_tables_and_strikethrough():
|
|
html = render("| a |\n|---|\n| 1 |\n\n~~old~~")
|
|
assert "<table" in html and "<s>old</s>" in html
|
|
|
|
|
|
def test_line_diff_hunks():
|
|
old = "\n".join(f"line {i}" for i in range(1, 21))
|
|
new = old.replace("line 10", "line ten")
|
|
[hunk] = line_diff(old, new)
|
|
kinds = [(line.kind, line.old_number, line.new_number) for line in hunk]
|
|
assert ("removed", 10, None) in kinds
|
|
assert ("added", None, 10) in kinds
|
|
assert kinds[0] == ("same", 7, 7) # three lines of context
|
|
assert line_diff(old, old) == []
|