import re import unittest from unittest.mock import MagicMock, patch import markdown from mdx_oembed import endpoints from mdx_oembed.inlinepatterns import OEMBED_LINK_RE, _is_image_url, _sanitize_html # --------------------------------------------------------------------------- # Regex tests # --------------------------------------------------------------------------- class TestOEmbedRegex(unittest.TestCase): """Tests for the raw OEMBED_LINK_RE pattern.""" def setUp(self): self.re = re.compile(OEMBED_LINK_RE) # --- should NOT match (relative URLs) --- def test_ignore_relative_image_link(self): assert self.re.search("![image](/image.png)") is None # --- should match (absolute URLs — image filtering is in Python now) --- def test_match_absolute_url(self): m = self.re.search("![img](http://example.com/photo.png)") assert m is not None def test_match_youtube_link(self): m = self.re.search("![video](http://www.youtube.com/watch?v=ABC)") assert m is not None assert m.group(2) == "http://www.youtube.com/watch?v=ABC" def test_match_youtube_short_link(self): m = self.re.search("![video](http://youtu.be/ABC)") assert m is not None def test_match_https(self): m = self.re.search("![video](https://youtu.be/ABC)") assert m is not None def test_match_protocol_relative(self): m = self.re.search("![video](//youtu.be/ABC)") assert m is not None def test_alt_text_captured(self): m = self.re.search("![my alt text](https://example.com/embed)") assert m is not None assert m.group(1) == "my alt text" # --------------------------------------------------------------------------- # Image URL detection # --------------------------------------------------------------------------- class TestIsImageUrl(unittest.TestCase): def test_common_extensions(self): for ext in ("png", "jpg", "jpeg", "gif", "webp", "avif", "svg", "bmp", "tiff", "ico"): assert _is_image_url(f"http://example.com/photo.{ext}") is True, ext def test_case_insensitive(self): assert _is_image_url("http://example.com/Photo.PNG") is True assert _is_image_url("http://example.com/photo.JpEg") is True def test_query_string_ignored(self): assert _is_image_url("http://example.com/photo.jpg?size=large") is True def test_non_image(self): assert _is_image_url("http://www.youtube.com/watch?v=ABC") is False def test_no_extension(self): assert _is_image_url("http://example.com/embed") is False # --------------------------------------------------------------------------- # HTML sanitization # --------------------------------------------------------------------------- class TestSanitizeHtml(unittest.TestCase): def test_allows_iframe(self): html = '' result = _sanitize_html(html) assert "alert("xss")' ) output = self._convert("![v](http://www.youtube.com/watch?v=ABC)", evil_consumer) assert "", "type": "video"} resp.get = lambda key, default=None: data.get(key, default) resp.__getitem__ = lambda self_inner, key: data[key] return resp raise _oembed.OEmbedNoEndpoint("nope") consumer = MagicMock() consumer.embed.side_effect = side_effect with patch("mdx_oembed.extension.oembed.OEmbedConsumer", return_value=consumer): md = markdown.Markdown( extensions=["oembed"], extension_configs={ "oembed": {"allowed_endpoints": [endpoints.YOUTUBE]}, }, ) yt_output = md.convert("![v](http://www.youtube.com/watch?v=A)") assert "