Open History to see the last commit
1import { describe, expect, it } from "vite-plus/test";
2
3import { classifyMarkdownImageSource } from "./markdownImages.js";
4
5describe("classifyMarkdownImageSource", () => {
6 it.each([
7 ["images/result.png", "/workspace/project", "/workspace/project/images/result.png"],
8 [
9 "images\\result.png",
10 "C:\\Users\\dara\\project",
11 "C:\\Users\\dara\\project\\images\\result.png",
12 ],
13 ["file:///workspace/project/image%20one.png", null, "/workspace/project/image one.png"],
14 ["file://server/share/image.png", "\\\\server\\share", "\\\\server\\share\\image.png"],
15 ])("maps %s to a workspace file", (source, workspaceRoot, path) => {
16 expect(classifyMarkdownImageSource(source, workspaceRoot)).toEqual({
17 _tag: "WorkspaceFile",
18 path,
19 ...(source.startsWith("file:") ? {} : { relative: true }),
20 });
21 });
22
23 it.each(["image.png", "javascript:alert(1)", "file://%"])(
24 "blocks unsupported or unresolved source %s",
25 (source) => {
26 expect(classifyMarkdownImageSource(source)).toEqual({ _tag: "Blocked" });
27 },
28 );
29
30 // Loading these makes Windows send the user's NTLM credentials to the named host.
31 it.each([
32 "file://attacker.test/share/cat.jpg",
33 "\\\\attacker.test\\share\\cat.jpg",
34 "/\\attacker.test\\share\\cat.jpg",
35 "file:/%5Cattacker.test%5Cshare%5Ccat.jpg",
36 "\\\\server\\other\\cat.jpg",
37 ])("blocks network path %s outside the project", (source) => {
38 expect(classifyMarkdownImageSource(source, "\\\\server\\share\\project")).toEqual({
39 _tag: "Blocked",
40 });
41 });
42});