improvements

test/markdown.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest'
+import { renderMarkdown } from '../src/renderer/src/markdown'
+
+describe('renderMarkdown', () => {
+  it('renders headings, bold, italic and links', () => {
+    const html = renderMarkdown('# Title\n\nSome **bold** and *italic* and [a](https://x.com).')
+    expect(html).toContain('<h1>Title</h1>')
+    expect(html).toContain('<strong>bold</strong>')
+    expect(html).toContain('<em>italic</em>')
+    expect(html).toContain('<a href="https://x.com" target="_blank" rel="noreferrer">a</a>')
+  })
+
+  it('restores code spans without colliding with surrounding digits', () => {
+    // " 0 " around the text used to clash with the placeholder index — guard it.
+    const html = renderMarkdown('I have 0 cats and `code` and 1 dog.')
+    expect(html).toContain('<code>code</code>')
+    expect(html).toContain('I have 0 cats')
+    expect(html).toContain('1 dog.')
+    expect(html).not.toContain('undefined')
+  })
+
+  it('escapes HTML and never passes through raw tags', () => {
+    const html = renderMarkdown('A <script>alert(1)</script> tag.')
+    expect(html).toContain('&lt;script&gt;')
+    expect(html).not.toContain('<script>')
+  })
+
+  it('drops dangerous link schemes but keeps the text', () => {
+    const html = renderMarkdown('[click](javascript:alert(1))')
+    expect(html).not.toContain('javascript:')
+    expect(html).toContain('click')
+  })
+
+  it('highlights fenced code blocks', () => {
+    const html = renderMarkdown('```js\nconst a = 1\n```')
+    expect(html).toContain('<pre class="md-code">')
+    expect(html).toContain('const')
+  })
+
+  it('renders unordered and ordered lists', () => {
+    expect(renderMarkdown('- a\n- b')).toContain('<ul><li>a</li><li>b</li></ul>')
+    expect(renderMarkdown('1. a\n2. b')).toContain('<ol><li>a</li><li>b</li></ol>')
+  })
+})