(allura) 06/33: [#8607] add comments, add test

[br...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch db/8607
in repository https://gitbox.apache.org/repos/asf/allura.git

commit 8ab23957448e85b1549bb240728d4239c933fb43
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Fri May 15 13:05:16 2026 -0400

    [#8607] add comments, add test
---
 Allura/allura/lib/widgets/resources/js/combobox.js |  2 +-
 Allura/allura/tests/functional/test_home.py        |  9 +++++++
 Allura/allura/tests/test_helpers.py                | 31 ++++++++++++++++++++++
 3 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/Allura/allura/lib/widgets/resources/js/combobox.js b/Allura/allura/lib/widgets/resources/js/combobox.js
index 782147620..9c6762bf6 100644
--- a/Allura/allura/lib/widgets/resources/js/combobox.js
+++ b/Allura/allura/lib/widgets/resources/js/combobox.js
@@ -140,7 +140,7 @@
       input.autocomplete('instance')._renderItem = function(ul, item) {
         return $('<li>')
           .data('item.autocomplete', item)
-          .append('<a>' + item.label + '</a>')
+          .append('<a>' + item.label + '</a>')  // escape_html not needed, its already used above
           .appendTo(ul);
       };
 
diff --git a/Allura/allura/tests/functional/test_home.py b/Allura/allura/tests/functional/test_home.py
index b98c5ba7d..8f4047320 100644
--- a/Allura/allura/tests/functional/test_home.py
+++ b/Allura/allura/tests/functional/test_home.py
@@ -191,6 +191,15 @@ def test_users(self):
         }]
         assert j['options'] == expected
 
+    def test_users_json_endpoint_escaped(self):
+        # escaping also tested by test_json_encoding_directly but that is more low-level this is more functional
+
+        M.User.by_username('test-admin').display_name = 'Test Admin <b>foo</b>'
+        ThreadLocalODMSession.flush_all()
+        r = self.app.get('/p/test/users')
+        assert r.json['options'][0]['label'] == 'Test Admin <b>foo</b> (test-admin)'  # JSON interpreted ok
+        assert 'Test Admin \\u003Cb>foo\\u003C/b> (test-admin)' in r.text  # raw value is escaped
+
     def test_members(self):
         nbhd = M.Neighborhood.query.get(name='Projects')
         self.app.post('/admin/groups/create', params={'name': 'B_role'})
diff --git a/Allura/allura/tests/test_helpers.py b/Allura/allura/tests/test_helpers.py
index 9d8f64c22..b442842d1 100644
--- a/Allura/allura/tests/test_helpers.py
+++ b/Allura/allura/tests/test_helpers.py
@@ -271,6 +271,27 @@ def test_render_any_markup_plain():
             'readme.txt', '<b>blah</b>\n<script>alert(1)</script>\nfoo') ==
         '<pre>&lt;b&gt;blah&lt;/b&gt;\n&lt;script&gt;alert(1)&lt;/script&gt;\nfoo</pre>')
 
+def test_render_any_markup_plain_code_mode_inline():
+    assert (
+        h.render_any_markup(
+            'readme.txt', '<b>blah</b>\n<script>alert(1)</script>\nfoo',
+            code_mode=True, linenumbers_style=h.INLINE) ==
+        '<div class="codehilite"><pre><span id="l1" class="code_block"><span class="lineno">1</span> '
+        '&lt;b&gt;blah&lt;/b&gt;</span><span id="l2" class="code_block"><span class="lineno">2</span> '
+        '&lt;script&gt;alert(1)&lt;/script&gt;</span><span id="l3" class="code_block"><span class="lineno">3</span> '
+        'foo</span></pre></div>')
+
+def test_render_any_markup_plain_code_mode_table():
+    assert (
+        h.render_any_markup(
+            'readme.txt', '<b>blah</b>\n<script>alert(1)</script>\nfoo',
+            code_mode=True, linenumbers_style=h.TABLE) ==
+        '<table class="codehilitetable"><tbody><tr><td class="linenos"><div class="linenodiv"><pre>1\n'
+        '2\n'
+        '3</pre></div></td><td class="code"><div class="codehilite"><pre><span id="l1" class="code_block">&lt;b&gt;blah&lt;/b&gt;\n'
+        '</span><span id="l2" class="code_block">&lt;script&gt;alert(1)&lt;/script&gt;\n'
+        '</span><span id="l3" class="code_block">foo</span></pre></div></td></tr></tbody></table>'
+    )
 
 def test_render_any_markup_formatting():
     assert (str(h.render_any_markup('README.md', '### foo\n'
@@ -280,6 +301,16 @@ def test_render_any_markup_formatting():
             '&lt;script&gt;</span>alert(1)<span class="nt">'
             '&lt;/script&gt;</span>bar\n</code></pre></div>\n</div>')
 
+def test_render_any_markup_rst():
+    assert (str(h.render_any_markup('README.rst', 'foo\n===\n\nbar\n<script>alert(1)</script>')) ==
+            '<div class="document">\n'
+            '<div class="section" id="foo">\n'
+            '<h1>foo</h1>\n'
+            '<p>bar\n'
+            '&lt;script&gt;alert(1)&lt;/script&gt;</p>\n'
+            '</div>\n'
+            '</div>\n')
+
 
 def test_render_any_markdown_encoding():
     # send encoded content in, make sure it converts it to actual unicode object which Markdown lib needs