fix(compose): document what actually suppresses raw HTML, item 123

CMARK_OPT_SAFE has had no effect since cmark-gfm made safe mode the
default; the flag is retained for API compatibility and the real
protection is that CMARK_OPT_UNSAFE is never set. Measured against
0.29.0.gfm.13: rendering with OPT_DEFAULT alone, with OPT_SAFE, and with
OPT_UNSAFE shows the first two suppress a script element and a
javascript: link while the third leaks both.

The comment credited the flag, which would have sent the next reader to
the wrong place, and the test could not tell the two apart: it would
have passed just as well with the flag deleted. What it has to guard
against is OPT_UNSAFE being introduced, so it now also asserts that
unsafe links are stripped, which is a protection this gets for free and
previously asserted nothing about.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015muoUo2GdxmBDSp5vjYcbE

1 files changed, 26 insertions, 3 deletions

diff --git a/tests/test_markdownrenderer.cpp b/tests/test_markdownrenderer.cpp
index 44f3ccb..0c35b6c 100644
--- a/tests/test_markdownrenderer.cpp
+++ b/tests/test_markdownrenderer.cpp
@@ -35,6 +35,7 @@ private slots:
     void tasklistRenders();
     void tablesAreNotEnabled();
     void rawHtmlIsSuppressed();
+    void unsafeLinksAreStripped();
     void accentedTextSurvivesAsUtf8();
     void emptyInputProducesEmptyOutput();
 };
@@ -90,15 +91,37 @@ void TestMarkdownRenderer::tablesAreNotEnabled()
 
 void TestMarkdownRenderer::rawHtmlIsSuppressed()
 {
-    // CMARK_OPT_SAFE. The body is the user's own text, but a body that can
-    // inject markup into its own generated HTML part is a sharp edge with no
-    // upside.
+    // Safe mode (the cmark-gfm 0.29 default, not CMARK_OPT_SAFE, which is a
+    // no-op in this version, see markdownrenderer.cpp). The body is the
+    // user's own text, but a body that can inject markup into its own
+    // generated HTML part is a sharp edge with no upside.
+    //
+    // Asserted on the actual placeholder rather than only "no <script>",
+    // because the weaker assertion would still pass with CMARK_OPT_UNSAFE
+    // set by mistake, as long as something ELSE in the string also matched
+    // "not <script>" and "contains after" (measured: it does not distinguish
+    // safe from unsafe mode on its own). "raw HTML omitted" is what safe mode
+    // actually emits in place of the tag.
     const QString html = MarkdownRenderer::toHtml(
         QStringLiteral("<script>alert(1)</script>\n\nafter"));
     QVERIFY2(!html.contains(QStringLiteral("<script>")), qPrintable(html));
+    QVERIFY2(html.contains(QStringLiteral("raw HTML omitted")), qPrintable(html));
     QVERIFY2(html.contains(QStringLiteral("after")), qPrintable(html));
 }
 
+void TestMarkdownRenderer::unsafeLinksAreStripped()
+{
+    // A protection this gets for free from safe mode, and previously
+    // asserted nothing about: a javascript: link is replaced with an empty
+    // href rather than passed through. The body is the user's own text, but
+    // it is rendered into an HTML part sent to other people, so a
+    // javascript: link surviving into that part would be a real defect, not
+    // a cosmetic one.
+    const QString html = MarkdownRenderer::toHtml(
+        QStringLiteral("[click](javascript:alert(1))"));
+    QVERIFY2(!html.contains(QStringLiteral("javascript:")), qPrintable(html));
+}
+
 void TestMarkdownRenderer::accentedTextSurvivesAsUtf8()
 {
     // This user writes Italian, so accented text is every message rather