MarkdownConverter

AlexP11223 · AlexP11223 · commit 0fa40f4076d9 · 2015-04-29T08:37:11.000+03:00
diff --git a/src/main/java/alexp/blog/model/Comment.java b/src/main/java/alexp/blog/model/Comment.java
@@ -1,6 +1,6 @@
 package alexp.blog.model;
 
-import com.github.rjeschke.txtmark.Processor;
+import alexp.blog.service.MarkdownConverter;
 import org.hibernate.validator.constraints.NotBlank;
 
 import javax.persistence.*;
@@ -44,7 +44,7 @@ public String getCommentText() {
     }
 
     public String getCommentTextHtml() {
-        return Processor.process(getCommentText(), true);
+        return MarkdownConverter.toHtml(getCommentText());
     }
 
     public Date getDateTime() {
diff --git a/src/main/java/alexp/blog/model/Post.java b/src/main/java/alexp/blog/model/Post.java
@@ -1,6 +1,6 @@
 package alexp.blog.model;
 
-import com.github.rjeschke.txtmark.Processor;
+import alexp.blog.service.MarkdownConverter;
 import org.hibernate.validator.constraints.NotBlank;
 import org.springframework.util.StringUtils;
 
@@ -60,11 +60,11 @@ public boolean hasShortTextPart() {
     }
 
     public String shortTextPartHtml() {
-        return Processor.process(getShortTextPart(), true);
+        return MarkdownConverter.toHtml(getShortTextPart());
     }
 
     public String fullPostTextHtml() {
-        return Processor.process(getFullPostText().replace(shortPartSeparator(), ""), true);
+        return MarkdownConverter.toHtml(getFullPostText().replace(shortPartSeparator(), ""));
     }
 
     public Long getId() {
diff --git a/src/main/java/alexp/blog/service/MarkdownConverter.java b/src/main/java/alexp/blog/service/MarkdownConverter.java
@@ -0,0 +1,10 @@
+package alexp.blog.service;
+
+import com.github.rjeschke.txtmark.Processor;
+
+public class MarkdownConverter {
+
+    public static String toHtml(String input) {
+        return Processor.process(input, true);
+    }
+}
diff --git a/src/test/java/alexp/blog/service/MarkdownConverterTest.java b/src/test/java/alexp/blog/service/MarkdownConverterTest.java
@@ -0,0 +1,17 @@
+package alexp.blog.service;
+
+import org.junit.Test;
+
+import static org.hamcrest.CoreMatchers.*;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+public class MarkdownConverterTest {
+
+    @Test
+    public void shouldReturnHtmlAndEscapeScript() {
+        String html = MarkdownConverter.toHtml("hello **world**! <script>alert('pwnd');</script>");
+
+        assertThat(html, containsString("<strong>"));
+        assertThat(html, not(containsString("<script>")));
+    }
+}

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`package alexp.blog.model;`
`2`	`2`
`3`		`-import com.github.rjeschke.txtmark.Processor;`
	`3`	`+import alexp.blog.service.MarkdownConverter;`
`4`	`4`	`import org.hibernate.validator.constraints.NotBlank;`
`5`	`5`
`6`	`6`	`import javax.persistence.*;`
`@@ -44,7 +44,7 @@ public String getCommentText() {`
`44`	`44`	`}`
`45`	`45`
`46`	`46`	`public String getCommentTextHtml() {`
`47`		`- return Processor.process(getCommentText(), true);`
	`47`	`+ return MarkdownConverter.toHtml(getCommentText());`
`48`	`48`	`}`
`49`	`49`
`50`	`50`	`public Date getDateTime() {`