package markup

import (
	"strings"
	"testing"
)

// Chapter 45.4's attacks, each a permanent test: no tag survives, though inert words may.
func TestChapter45Attacks(t *testing.T) {
	cases := []struct {
		name, body string
		forbidden  []string
	}{
		{"script tag", `<script>alert(1)</script>`, []string{"<script"}},
		{"script inline in a paragraph", `hello <script>alert(1)</script> there`, []string{"<script"}},
		{"script split across lines", "a\n<script>\nalert(1)\n</script>\nb", []string{"<script"}},
		{"javascript link", `[x](javascript:alert(1))`, []string{"javascript:"}},
		{"image onerror", `<img src=x onerror=alert(1)>`, []string{"onerror", "alert(1)"}},
		{"encoded javascript", `<a href="java&#115;cript:alert(1)">x</a>`, []string{"javascript:", "java&#115;cript"}},
		{"data url", `[x](data:text/html;base64,PHNjcmlwdD4=)`, []string{"data:"}},
		{"vbscript", `[x](vbscript:msgbox(1))`, []string{"vbscript:"}},
		{"file url", `[x](file:///etc/passwd)`, []string{"file:"}},
		{"iframe", `<iframe src="https://evil.example"></iframe>`, []string{"<iframe", "evil.example"}},
		{"form", `<form action="/x"><input name="p"></form>`, []string{"<form", "<input"}},
		{"svg", `<svg onload="alert(1)"><circle /></svg>`, []string{"<svg", "onload"}},
		{"style attribute", `<p style="position:fixed;top:0">x</p>`, []string{"style="}},
		{"style element", `<style>body{display:none}</style>`, []string{"<style", "display:none"}},
		{"object", `<object data="evil.swf"></object>`, []string{"<object"}},
		{"embed", `<embed src="evil.swf">`, []string{"<embed"}},
		{"leading space scheme", `<a href=" javascript:alert(1)">x</a>`, []string{"javascript:"}},
		{"upper case scheme", `<a href="JaVaScRiPt:alert(1)">x</a>`, []string{"avascript:", "alert(1)"}},
		{"null byte scheme", "<a href=\"java\x00script:alert(1)\">x</a>", []string{"script:alert"}},
		{"meta refresh", `<meta http-equiv="refresh" content="0;url=https://evil.example">`, []string{"<meta", "refresh"}},
		{"base tag", `<base href="https://evil.example/">`, []string{"<base"}},
	}
	for _, c := range cases {
		got := strings.ToLower(Render(c.body))
		for _, bad := range c.forbidden {
			if strings.Contains(got, strings.ToLower(bad)) {
				t.Errorf("%s: output still contains %q\n  %s", c.name, bad, got)
			}
		}
	}
}

// What survives matters too, because a sanitizer that strips everything is safe and useless.
func TestOrdinaryMarkdownSurvives(t *testing.T) {
	body := "# heading\n\nsome **bold** and *italic* and `code`.\n\n" +
		"- one\n- two\n\n> quoted\n\n```go\nfunc main() {}\n```\n\n" +
		"[forge](https://barerepo.example) and a table:\n\n" +
		"| a | b |\n|---|---|\n| 1 | 2 |\n"
	got := Render(body)
	for _, want := range []string{
		"<h1>heading</h1>", "<strong>bold</strong>", "<em>italic</em>",
		"<code>code</code>", "<ul>", "<li>one</li>", "<blockquote>",
		"<pre>", "func main()", "<table>", "<td>1</td>",
		`<a href="https://barerepo.example"`,
	} {
		if !strings.Contains(got, want) {
			t.Errorf("ordinary markdown lost %q\n  %s", want, got)
		}
	}
}

// Chapter 42.2: mark every external link, so no comment passes a referrer or window handle.
func TestExternalLinksAreMarked(t *testing.T) {
	got := Render(`[x](https://elsewhere.example)`)
	if !strings.Contains(got, `rel="nofollow noopener noreferrer"`) {
		t.Errorf("an external link has no rel attribute: %s", got)
	}
	local := Render(`[x](/john/johnbot)`)
	if strings.Contains(local, "nofollow") {
		t.Errorf("a link inside the site was marked external: %s", local)
	}
}

// Chapter 42.2: a remote image leaks the reader's address, and blocking is simpler and honest.
func TestRemoteImagesAreBlocked(t *testing.T) {
	got := Render(`![x](https://tracker.example/pixel.gif)`)
	if strings.Contains(got, "tracker.example") {
		t.Errorf("a remote image survived: %s", got)
	}
	if !strings.Contains(got, "<img") {
		return // dropping the whole tag is also an acceptable answer
	}
}

// A language class on a code block is the one class allowed, in chapter 42.1's form only.
func TestCodeClass(t *testing.T) {
	if got := Sanitize(`<code class="language-go">x</code>`); !strings.Contains(got, `class="language-go"`) {
		t.Errorf("a language class was stripped: %s", got)
	}
	if got := Sanitize(`<code class="anything-else">x</code>`); strings.Contains(got, "class") {
		t.Errorf("an arbitrary class survived: %s", got)
	}
}

// Text inside a stripped element stays out, or a script's body lands in front of the reader.
func TestDroppedElementsTakeTheirContents(t *testing.T) {
	got := Sanitize(`<script>var secret = 1;</script><p>kept</p>`)
	if strings.Contains(got, "secret") {
		t.Errorf("the body of a script survived: %s", got)
	}
	if !strings.Contains(got, "kept") {
		t.Errorf("the text after it was lost: %s", got)
	}
}

// A tag never opened must not close, or a comment escapes its box into the page's layout.
func TestUnbalancedTagsCannotEscape(t *testing.T) {
	got := Sanitize(`</div></body><p>hi</p>`)
	for _, bad := range []string{"</div>", "</body>"} {
		if strings.Contains(got, bad) {
			t.Errorf("a stray %q survived: %s", bad, got)
		}
	}
	open := strings.Count(Sanitize("<p>a<p>b"), "<p>")
	closed := strings.Count(Sanitize("<p>a<p>b"), "</p>")
	if open != closed {
		t.Errorf("unbalanced output: %d open, %d closed", open, closed)
	}
}

// Prose that mentions a tag keeps its sentence: the tag goes, the words stay, backticks show markup.
func TestProseAroundTagsSurvives(t *testing.T) {
	got := Render("use <div> for that")
	if !strings.Contains(got, "use") || !strings.Contains(got, "for that") {
		t.Errorf("the sentence was lost: %s", got)
	}
	// Backticks are the way to show a tag, and they work.
	code := Render("use `<div>` for that")
	if !strings.Contains(code, "&lt;div&gt;") {
		t.Errorf("a tag in backticks did not survive: %s", code)
	}
}

// Chapter 42.2 blocks a remote image and says so, because a silent gap reads as a broken page.
func TestARemoteImageIsBlockedOutLoud(t *testing.T) {
	got := Render("![a cat](https://example.com/cat.png)")
	if strings.Contains(got, "example.com") {
		t.Errorf("a remote image reached the page, so the reader's address goes with it:\n%s", got)
	}
	if !strings.Contains(got, "remote image blocked") {
		t.Errorf("the page does not say the image was blocked:\n%s", got)
	}
	if strings.Contains(got, "<img") {
		t.Errorf("a source-less img was left behind, which draws as broken:\n%s", got)
	}

	// A local image is barerepo's own bytes and stays.
	local := Render("![a diagram](/john/johnbot/raw/master/doc.png)")
	if !strings.Contains(local, "<img") || strings.Contains(local, "remote image blocked") {
		t.Errorf("a local image was blocked:\n%s", local)
	}
}

func TestOrderedListKeepsItsStart(t *testing.T) {
	got := Render("6. six\n7. seven\n")
	if !strings.Contains(got, `start="6"`) {
		t.Fatalf("start was dropped: %s", got)
	}
	if bad := Render("1. one\n"); strings.Contains(bad, "start=") {
		t.Fatalf("a list starting at one should not carry start: %s", bad)
	}
	if evil := Render(`<ol start="x() javascript:"><li>a</li></ol>`); strings.Contains(evil, "start=") {
		t.Fatalf("a non numeric start should be dropped: %s", evil)
	}
}