fix(deps): replace mdex with earmark parser

test/pleroma/formatter_test.exs

@@ -7,6 +7,7 @@ defmodule Pleroma.FormatterTest do
   alias Pleroma.User
   use Pleroma.DataCase
 
+  import Mock
   import Pleroma.Factory
 
   setup_all do
@@ -372,4 +373,85 @@ defmodule Pleroma.FormatterTest do
 
     assert Formatter.html_escape(text, "text/plain") == expected
   end
+
+  describe "markdown_to_html/2" do
+    test "escapes link attribute values" do
+      markdown = ~s|[click](http://example.com/?a=x" onerror="alert(1))|
+
+      html = Formatter.markdown_to_html(markdown)
+
+      assert html =~ ~s|href="http://example.com/?a=x"|
+      refute html =~ "onerror"
+    end
+
+    test "preserves entities without rendering dangerous raw HTML" do
+      markdown = "safe &amp; sound<script>alert(1)</script>"
+
+      assert Formatter.markdown_to_html(markdown) == "<p>safe &amp; sound</p>"
+
+      assert Formatter.markdown_to_html("<div><script>alert(1)</script>safe</div>") ==
+               "<div>safe</div>"
+
+      assert Formatter.markdown_to_html("<ScRiPt>alert(1)</ScRiPt>") == ""
+      assert Formatter.markdown_to_html("<BR>") == "<BR>"
+    end
+
+    test "escapes dangerous HTML inside code" do
+      markdown = "`<script>&amp;</script>`"
+
+      assert Formatter.markdown_to_html(markdown) ==
+               ~s(<p><code class="inline">&lt;script&gt;&amp;amp;&lt;/script&gt;</code></p>)
+    end
+
+    test "rejects entity-encoded URL delimiters" do
+      markdown = "[click](http://example.com/?a=x&#34;onerror=alert(1))"
+
+      html = Formatter.markdown_to_html(markdown)
+
+      assert html =~ ~s|href="http://example.com/?a=x"|
+      refute html =~ "onerror"
+    end
+
+    test "strips email autolinks without changing explicit mailto links" do
+      opts = %{strip_email_autolinks: true}
+
+      assert Formatter.markdown_to_html("<foo@example.com>", opts) ==
+               "<p>foo@example.com</p>"
+
+      assert Formatter.markdown_to_html("[email](mailto:foo@example.com)", opts) ==
+               ~s(<p><a href="mailto:foo@example.com">email</a></p>)
+    end
+
+    test "handles malformed Markdown that crashed older EarmarkParser releases" do
+      assert Formatter.markdown_to_html("\\[{:}") == "<p>[{:}</p>"
+    end
+
+    test "handles a malformed Markdown regression corpus" do
+      markdown_samples = [
+        "- hello\n{:.claass .klass}",
+        "[link](\"",
+        "<script",
+        "</style>",
+        "~~~",
+        "<![CDATA[",
+        <<0>>
+      ]
+
+      for markdown <- markdown_samples do
+        html = Formatter.markdown_to_html(markdown)
+
+        assert is_binary(html)
+        refute html =~ <<0>>
+      end
+    end
+
+    test "falls back to escaped text when parsing fails" do
+      markdown = "<script>alert(1)</script>\nnext"
+
+      with_mock EarmarkParser, as_ast: fn _text, _opts -> raise "parser failed" end do
+        assert Formatter.markdown_to_html(markdown, %{breaks: true}) ==
+                 "<p>&lt;script&gt;alert(1)&lt;/script&gt;<br>next</p>"
+      end
+    end
+  end
 end