fixed implementation of UGC content uploader

2026-08-03 18:57:39 -05:00
parent 39e31d3980
commit 473b3c811b
40 changed files with 4137 additions and 87 deletions
@@ -298,6 +298,56 @@ class ProfilePageTests(GatedTestCase):
        self.alice.userprofile.refresh_from_db()
        self.assertEqual(self.alice.userprofile.bio, fancy)

+    def _set_bio(self, text):
+        self.alice.userprofile.bio = text
+        self.alice.userprofile.save()
+
+    def test_bio_renders_markdown(self):
+        self._set_bio('# Hi\n\n**bold** and *italic* and `code`')
+        self.gate()
+        resp = self.client.get(reverse('profiles:user_profile', args=['Alice']))
+        self.assertContains(resp, '<h1>Hi</h1>', html=True)
+        self.assertContains(resp, '<strong>bold</strong>', html=True)
+        self.assertContains(resp, '<em>italic</em>', html=True)
+
+    def test_bio_raw_html_escaped(self):
+        self._set_bio('<script>alert(1)</script>')
+        self.gate()
+        resp = self.client.get(reverse('profiles:user_profile', args=['Alice']))
+        self.assertNotContains(resp, '<script>alert(1)</script>', html=True)
+        self.assertContains(resp, '&lt;script&gt;alert(1)&lt;/script&gt;')
+
+    def test_bio_dangerous_link_scheme_rejected(self):
+        self._set_bio('[x](javascript:alert(1))')
+        self.gate()
+        resp = self.client.get(reverse('profiles:user_profile', args=['Alice']))
+        self.assertNotContains(resp, 'href="javascript:alert(1)"')
+
+    def test_bio_gfm_features(self):
+        self._set_bio('| a | b |\n|---|---|\n| 1 | 2 |\n\n~~gone~~')
+        self.gate()
+        resp = self.client.get(reverse('profiles:user_profile', args=['Alice']))
+        self.assertContains(resp, '<table>', html=False)
+        self.assertContains(resp, '<s>gone</s>', html=False)
+
+    def test_bio_preview_requires_login(self):
+        self.gate()
+        resp = self.client.post(reverse('profiles:bio_preview'), {'bio': '# x'})
+        self.assertEqual(resp.status_code, 302)
+
+    def test_bio_preview_renders(self):
+        self.gate()
+        self.client.login(username='Alice', password='pw')
+        resp = self.client.post(reverse('profiles:bio_preview'), {'bio': '**hi** *there*'})
+        self.assertEqual(resp.status_code, 200)
+        self.assertJSONEqual(resp.content, {'html': '<p><strong>hi</strong> <em>there</em></p>'})
+
+    def test_bio_preview_get_rejected(self):
+        self.gate()
+        self.client.login(username='Alice', password='pw')
+        resp = self.client.get(reverse('profiles:bio_preview'))
+        self.assertEqual(resp.status_code, 405)
+

 class FileRequestTests(MediaTestCase, GatedTestCase):
    def setUp(self):