Ilker ManapandClaude Opus 5.5
3fea39feb9
Opening a repository shows its model card, rendered from markdown, with its base model, license and languages above it; the listing names each repository's base model and license under its name. The card is a stranger's text: raw HTML and dangerous links are dropped, images are shown as links rather than loaded, and relative links point into the repository. Adds github.com/yuin/goldmark for the markdown. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
31 lines
1.1 KiB
Go
31 lines
1.1 KiB
Go
package web
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestAModelCardCannotRunOrLoadAnything(t *testing.T) {
|
|
card := "# Qwen\n\nA **small** model.\n\n<script>alert(1)</script>\n\n" +
|
|
"<img src=x onerror=alert(1)>\n\n[click](javascript:alert(1))\n\n" +
|
|
"\n\n[license](LICENSE)\n\n" +
|
|
"| a | b |\n|---|---|\n| 1 | 2 |\n"
|
|
got := string(renderCard(card, "https://huggingface.co/Qwen/X/blob/abc/"))
|
|
|
|
for _, bad := range []string{"<script", "onerror", "javascript:", "<img"} {
|
|
if strings.Contains(got, bad) {
|
|
t.Errorf("the card rendered %q: %s", bad, got)
|
|
}
|
|
}
|
|
// Shown as a link to the picture, not fetched by the page.
|
|
if !strings.Contains(got, `href="https://tracker.example/pixel.png">[benchmark]</a>`) {
|
|
t.Errorf("an image should become a link: %s", got)
|
|
}
|
|
if !strings.Contains(got, `href="https://huggingface.co/Qwen/X/blob/abc/LICENSE"`) {
|
|
t.Errorf("a relative link should point into the repository: %s", got)
|
|
}
|
|
if !strings.Contains(got, "<strong>small</strong>") || !strings.Contains(got, "<table>") {
|
|
t.Errorf("the markdown should render, tables included: %s", got)
|
|
}
|
|
}
|