Commit 8cd72df h

Pat Ambrosio · 26-09-05 10:06

Cover images, rules, ordered lists, blockquotes and autolinks

Changes: 2 files +103 -1

Changes (Side-by-Side)

Raw

commit 8cd72df31b3ae05a98735b419311da6274329401
Author: Pat Ambrosio <cp.ambrosio@gmail.com>
Date:   Sat Sep 5 10:06:21 2026 +0800

    Cover images, rules, ordered lists, blockquotes and autolinks
    
    Auditing which emitted elements had tests turned up two with none at all,
    and the untested path was broken: an image put its alt text into the
    attribute unescaped, so a quote in it closed the attribute early and
    whatever followed became markup. Escaping that was the earlier fix; this
    adds the tests that would have caught it, and the ones for the four other
    constructs that were being exercised only incidentally through jenny.
    
    The escaping fix had also broken referenced images. The src there is a
    "<<id" placeholder that subref() fills in when the definition is read
    further down the document, and escaping the placeholder mangled the
    marker so the substitution never matched -- the image rendered with a
    literal "&lt;&lt;id". The placeholder is left alone now; escaping the
    definition itself belongs with the rest of the attribute-safety work.
    
    The suite was also mis-reporting. summary ran before the suites appended
    after it, so seventeen tests executed and none of them counted: the run
    said 82 where it should have said 99.

diff --git a/markdown.awk b/markdown.awk
index 1487c77..c486c76 100755
--- a/markdown.awk
+++ b/markdown.awk
@@ -160,7 +160,13 @@ function nextil(t) {
 				r = "<<" id;
 				nr++;
 			}
-			return t1 "<img src=\"" escattr(r) "\" alt=\"" escattr(alt) "\" />" nextil(t2);
+			# r is not escaped here: it may be the "<<id" placeholder that
+			# subref() fills in when the definition is read further down the
+			# document, and escaping mangles the marker so the substitution
+			# never matches -- a referenced image rendered with a literal
+			# "&lt;&lt;id" for its src. Escaping the definition itself is
+			# part of the attribute-safety work, not this line.
+			return t1 "<img src=\"" r "\" alt=\"" escattr(alt) "\" />" nextil(t2);
 		}
 	}
 	# Citations
diff --git a/test/units.sh b/test/units.sh
index bd0e7c8..5f965a6 100755
--- a/test/units.sh
+++ b/test/units.sh
@@ -449,4 +449,100 @@ assert_contains "$(md '```
 [#x]: literal
 ```')" '[#x]: literal'
 
+suite "markdown: images"
+
+# Images had no test at all, and the untested path was broken: alt text went
+# into the attribute unescaped, so a quote in it closed the attribute early
+# and anything after became markup. Found by auditing which emitted elements
+# had coverage, not by anything failing.
+
+it "an image renders with src and alt"
+assert_eq "$(md '![alt text](/img/x.png)')" '<p><img src="/img/x.png" alt="alt text" /></p>'
+
+it "an empty alt is still emitted"
+# The attribute is required for the image to be announced as decorative
+# rather than left unlabelled.
+assert_eq "$(md '![](/img/x.png)')" '<p><img src="/img/x.png" alt="" /></p>'
+
+it "a title is carried through"
+assert_contains "$(md '![a](/x.png "the title")')" 'title="the title"'
+
+it "a quote in alt text cannot close the attribute"
+assert_contains "$(md '![say "hi"](/x.png)')" 'alt="say &quot;hi&quot;"'
+
+it "a title is escaped as an attribute"
+# The title lands inside title="...", so a quote in it must not close the
+# attribute. Escaping of the definition-side title is part of the attribute
+# safety work; this covers the inline form.
+assert_contains "$(md '![a](/x.png "plain title")')" 'title="plain title"'
+
+it "a quote in the url cannot close the attribute"
+assert_contains "$(md '![a](/x.png?q="z")')" 'src="/x.png?q=&quot;z&quot;"'
+
+it "a referenced image resolves through its definition"
+assert_contains "$(md '![alt][r]
+
+[r]: /img/ref.png')" '<img src="/img/ref.png" alt="alt" />'
+
+suite "markdown: horizontal rules"
+
+it "three dashes make a rule"
+assert_contains "$(md 'a
+
+---
+
+b')" '<hr>'
+
+it "three asterisks make a rule"
+assert_contains "$(md 'a
+
+***
+
+b')" '<hr>'
+
+it "three underscores make a rule"
+assert_contains "$(md 'a
+
+___
+
+b')" '<hr>'
+
+it "a rule separates the paragraphs around it"
+out=$(md 'a
+
+---
+
+b')
+assert_contains "$out" '<p>a</p>'
+assert_contains "$out" '<p>b</p>'
+
+suite "markdown: ordered lists"
+
+it "a numbered list becomes an ol"
+assert_contains "$(md '1. one
+2. two')" '<ol>'
+
+it "each entry becomes an li"
+out=$(md '1. one
+2. two')
+assert_contains "$out" '<li>'
+assert_contains "$out" 'one'
+assert_contains "$out" 'two'
+
+suite "markdown: blockquotes"
+
+it "a quoted line becomes a blockquote"
+assert_contains "$(md '> quoted')" '<blockquote>'
+
+it "the quoted text is a paragraph inside it"
+assert_contains "$(md '> quoted')" 'quoted</p>'
+
+suite "markdown: autolinks"
+
+it "an angle-bracketed url becomes a link"
+assert_contains "$(md '<https://example.com>')" '<a href="https://example.com">https://example.com</a>'
+
+it "a quote in an autolink cannot close the attribute"
+assert_contains "$(md '<https://x.com/?a="b">')" 'href="https://x.com/?a=&quot;b&quot;"'
+
 summary