From 1328d222680edf2ebdaea5624a7496240bd075f0 Mon Sep 17 00:00:00 2001
From: VirtualTam <virtualtam@flibidi.net>
Date: Wed, 8 Mar 2017 20:38:41 +0100
Subject: security: escape HTML entities when using Markdown

Adapted from https://github.com/shaarli/Shaarli/pull/785

Signed-off-by: VirtualTam <virtualtam@flibidi.net>
---
 tests/plugins/PluginMarkdownTest.php | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

(limited to 'tests/plugins/PluginMarkdownTest.php')

diff --git a/tests/plugins/PluginMarkdownTest.php b/tests/plugins/PluginMarkdownTest.php
index fa7e1d52..67bf8968 100644
--- a/tests/plugins/PluginMarkdownTest.php
+++ b/tests/plugins/PluginMarkdownTest.php
@@ -149,4 +149,22 @@ class PluginMarkdownTest extends PHPUnit_Framework_TestCase
         $data = hook_markdown_render_daily($data);
         $this->assertEquals($str, $data['cols'][0][0]['formatedDescription']);
     }
+
+    /**
+     * Make sure that the HTML tags are escaped.
+     */
+    public function testMarkdownWithHtmlEscape()
+    {
+        $md = '**strong** <strong>strong</strong>';
+        $html = '<div class="markdown"><p><strong>strong</strong> &lt;strong&gt;strong&lt;/strong&gt;</p></div>';
+        $data = array(
+            'links' => array(
+                0 => array(
+                    'description' => $md,
+                ),
+            ),
+        );
+        $data = hook_markdown_render_linklist($data);
+        $this->assertEquals($html, $data['links'][0]['description']);
+    }
 }
-- 
cgit v1.2.3