Artifact [0c0f895878]

Artifact 0c0f895878248bf6e32ec774df37fae1f89546b1a0071587819268d74191b5eb:

• File internal/markup/pikchr_test.go — part of check-in [58fe4cf214] at 2026-08-16 12:53:54 on branch trunk — markup: Pikchr diagrams via WebAssembly (fossil's third markup)

  pikchr.c built to a standalone WASI module (-DPIKCHR_SHELL -sSTANDALONE_WASM) and run under wazero, so the CGO-free constraint holds. Its own CLI reads - and writes SVG, so the host ABI is a pipe: no memory marshalling to get wrong. Renders text/x-pikchr artifacts and pikchr fences inside markdown; a diagram that will not compile degrades to its source plus the compiler's message.

  SVG does NOT ride the document policy. It gets a narrow allow-list derived by enumerating what the module actually emits (six elements, a closed geometry/paint attribute set, no script/href/foreignObject), so even a hole in Pikchr's own label escaping cannot reach a page. Fence placeholders are alphanumeric with a per-render nonce: an HTML parser rewrites control bytes, so a NUL-based marker does not survive sanitizing (caught by test). Provenance and the rebuild recipe are in the ledger. (user: dmestas, size: 2792) [annotate] [blame] [check-ins using]

package markup

import (
	"strings"
	"testing"
)

func TestRenderPikchrSanitized(t *testing.T) {
	out, err := RenderPikchr([]byte(`box "hello" fit; arrow right; circle "world" fit`))
	if err != nil {
		t.Fatal(err)
	}
	svg := string(out)
	if !strings.Contains(svg, "<svg") || !strings.Contains(svg, "hello") {
		t.Fatalf("svg missing content:\n%s", svg[:min(300, len(svg))])
	}
	// Geometry must survive the narrow policy — a diagram stripped of its
	// paths would render blank while still "passing".
	if !strings.Contains(svg, "<path") && !strings.Contains(svg, "<polygon") {
		t.Fatalf("geometry stripped by policy:\n%s", svg[:min(400, len(svg))])
	}
	if !strings.Contains(svg, "style=") {
		t.Fatalf("styling stripped, diagram would be invisible:\n%s", svg[:min(400, len(svg))])
	}
}

func TestPikchrLabelCannotInject(t *testing.T) {
	out, err := RenderPikchr([]byte(`box "</svg><script>alert(1)</script>" fit`))
	if err != nil {
		return // refusing to render is also an acceptable outcome
	}
	// The payload must survive only as escaped display text. Checking
	// for the raw substring would false-positive on "&lt;script&gt;",
	// which is exactly what correct escaping looks like.
	if strings.Contains(string(out), "<script") || strings.Contains(string(out), "javascript:") {
		t.Fatalf("unescaped script survived:\n%s", out)
	}
	if !strings.Contains(string(out), "&lt;script&gt;") {
		t.Fatalf("payload neither escaped nor removed:\n%s", out)
	}
}

func min(a, b int) int { if a < b { return a }; return b }

// A ```pikchr fence inside markdown becomes an inline diagram, and the
// surrounding document still renders normally.
func TestPikchrFenceInMarkdown(t *testing.T) {
	src := "Before.\n\n```pikchr\nbox \"fenced\" fit\n```\n\nAfter.\n"
	out, err := Render([]byte(src), nil)
	if err != nil {
		t.Fatal(err)
	}
	got := string(out)
	if !strings.Contains(got, "<svg") || !strings.Contains(got, "fenced") {
		t.Fatalf("fence not rendered as svg:\n%s", got)
	}
	if !strings.Contains(got, "Before.") || !strings.Contains(got, "After.") {
		t.Fatalf("surrounding markdown lost:\n%s", got)
	}
	// An ordinary code fence must still be a code block, not a diagram.
	out, _ = Render([]byte("```go\nfmt.Println()\n```\n"), nil)
	if strings.Contains(string(out), "<svg") {
		t.Fatalf("non-pikchr fence rendered as a diagram:\n%s", out)
	}
}

// A fence that will not compile shows its source plus the diagnostic,
// never a broken page or a silent blank.
func TestPikchrFenceErrorShowsSource(t *testing.T) {
	out, err := Render([]byte("```pikchr\nnot ( valid\n```\n"), nil)
	if err != nil {
		t.Fatal(err)
	}
	got := string(out)
	if !strings.Contains(got, "not ( valid") || !strings.Contains(got, "pikchr:") {
		t.Fatalf("bad diagram did not degrade to source + message:\n%s", got)
	}
}