mirror of
https://github.com/twigphp/Twig.git
synced 2026-09-01 21:17:21 +00:00
Nicolas Grekas
84982072c7
The `html_to_markdown` filter emits plain Markdown text, so the `is_safe` annotation is dropped entirely and autoescape now handles its output according to the surrounding context. The `markdown_to_html` and `inline_css` filters emit HTML, not text safe in every escaping context, so `is_safe => ['all']` produced unescaped HTML when their output was interpolated into a JS, CSS or URL context. The annotation is now `is_safe => ['html']`.
102 lines
2.9 KiB
PHP
102 lines
2.9 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of Twig.
|
|
*
|
|
* (c) Fabien Potencier
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Twig\Extra\Markdown\Tests;
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
use Twig\Environment;
|
|
use Twig\Extra\Markdown\DefaultMarkdown;
|
|
use Twig\Extra\Markdown\ErusevMarkdown;
|
|
use Twig\Extra\Markdown\LeagueMarkdown;
|
|
use Twig\Extra\Markdown\MarkdownExtension;
|
|
use Twig\Extra\Markdown\MarkdownRuntime;
|
|
use Twig\Extra\Markdown\MichelfMarkdown;
|
|
use Twig\Loader\ArrayLoader;
|
|
use Twig\RuntimeLoader\RuntimeLoaderInterface;
|
|
|
|
class FunctionalTest extends TestCase
|
|
{
|
|
/**
|
|
* @dataProvider getMarkdownTests
|
|
*/
|
|
public function testMarkdown(string $template, string $expected)
|
|
{
|
|
foreach ([LeagueMarkdown::class, ErusevMarkdown::class, /* MichelfMarkdown::class, */ DefaultMarkdown::class] as $class) {
|
|
$twig = new Environment(new ArrayLoader([
|
|
'index' => $template,
|
|
'html' => <<<EOF
|
|
Hello
|
|
=====
|
|
|
|
Great!
|
|
EOF,
|
|
]));
|
|
$twig->addExtension(new MarkdownExtension());
|
|
$twig->addRuntimeLoader(new class($class) implements RuntimeLoaderInterface {
|
|
private $class;
|
|
|
|
public function __construct(string $class)
|
|
{
|
|
$this->class = $class;
|
|
}
|
|
|
|
public function load(string $c): ?object
|
|
{
|
|
return MarkdownRuntime::class === $c ? new $c(new $this->class()) : null;
|
|
}
|
|
});
|
|
$this->assertMatchesRegularExpression('{'.$expected.'}m', trim($twig->render('index')));
|
|
}
|
|
}
|
|
|
|
public static function getMarkdownTests()
|
|
{
|
|
return [
|
|
[<<<EOF
|
|
{% apply markdown_to_html %}
|
|
Hello
|
|
=====
|
|
|
|
Great!
|
|
{% endapply %}
|
|
EOF, "<h1>Hello</h1>\n+<p>Great!</p>"],
|
|
[<<<EOF
|
|
{% apply markdown_to_html %}
|
|
Hello
|
|
=====
|
|
|
|
Great!
|
|
{% endapply %}
|
|
EOF, "<h1>Hello</h1>\n+<p>Great!</p>"],
|
|
["{{ include('html')|markdown_to_html }}", "<h1>Hello</h1>\n+<p>Great!</p>"],
|
|
];
|
|
}
|
|
|
|
public function testMarkdownToHtmlIsNotSafeInJsContext()
|
|
{
|
|
$twig = new Environment(new ArrayLoader([
|
|
'index' => "{% autoescape 'js' %}{{ '# Hello'|markdown_to_html }}{% endautoescape %}",
|
|
]));
|
|
$twig->addExtension(new MarkdownExtension());
|
|
$twig->addRuntimeLoader(new class implements RuntimeLoaderInterface {
|
|
public function load(string $c): ?object
|
|
{
|
|
return MarkdownRuntime::class === $c ? new $c(new DefaultMarkdown()) : null;
|
|
}
|
|
});
|
|
|
|
$output = $twig->render('index');
|
|
|
|
$this->assertStringNotContainsString('<h1>', $output);
|
|
$this->assertMatchesRegularExpression('{\\\\u003[Cc]h1\\\\u003[Ee]Hello\\\\u003[Cc]\\\\/h1\\\\u003[Ee]}', $output);
|
|
}
|
|
}
|