@@ -665,6 +665,26 @@ def test_convert_RDOCLINK_ref
665
665
assert_equal "\n <p>C</p>\n " , result
666
666
end
667
667
668
+ def test_convert_RDOCLINK_escape_image
669
+ assert_escaped '<script>' , 'rdoc-image:"><script>alert(`rdoc-image`)</script>"'
670
+ end
671
+
672
+ def test_convert_RDOCLINK_escape_label_id
673
+ assert_escaped '<script>' , 'rdoc-label::path::"><script>alert(`rdoc-label_id`)</script>"'
674
+ end
675
+
676
+ def test_convert_RDOCLINK_escape_label_path
677
+ assert_escaped '<script>' , 'rdoc-label::"><script>alert(`rdoc-label_path`)</script>"'
678
+ end
679
+
680
+ def test_convert_RDOCLINK_escape_ref
681
+ assert_escaped '<script>' , 'rdoc-ref:"><script>alert(`rdoc-ref`)</script>"'
682
+ end
683
+
684
+ def test_convert_RDOCLINK_escape_xxx
685
+ assert_escaped '<script>' , 'rdoc-xxx:"><script>alert(`rdoc-xxx`)</script>"'
686
+ end
687
+
668
688
def test_convert_TIDYLINK_footnote
669
689
result = @to . convert 'text{*1}[rdoc-label:foottext-1:footmark-1]'
670
690
@@ -690,6 +710,11 @@ def test_convert_TIDYLINK_image
690
710
"\n <p><a href=\" http://example.com\" ><img src=\" path/to/image.jpg\" ></a></p>\n "
691
711
692
712
assert_equal expected , result
713
+
714
+ result =
715
+ @to . convert '{rdoc-image:<script>alert`link text`</script>}[http://example.com]'
716
+
717
+ assert_not_include result , "<script>"
693
718
end
694
719
695
720
def test_convert_TIDYLINK_rdoc_label
0 commit comments