)', '',
'pasted
',
'',
'js ',
'data ',
'space ',
'proto-relative ',
'ok ',
'rel
',
'img ',
'img ',
'img
',
'styled
',
].join('');
await paste(HTML, '[x](javascript:window.injected=22) ');
await h.wait('document.querySelector("#doc-visual .ProseMirror").textContent.includes("pasted")');
const view = await h.inert();
assert.deepEqual(view.bad, [], 'no script, image, frame, object, style or form came in');
assert.equal(view.handlers, 0);
assert.equal(view.hrefs, 0);
assert.deepEqual(view.fetched, []);
assert.equal(view.injected, null);
assert.deepEqual(view.links.map(l => l[0]).sort(), ['../docs/rel.md', 'https://ok.example/p'], 'only targets the gate accepts became links');
for (const [, rel, target] of view.links) assert.deepEqual([rel, target], ['noopener noreferrer', '_blank']);
assert.equal(await h.q('document.querySelector("#doc-visual .ProseMirror [style*=url]")'), null, 'no style attribute came in');
// pasting plain text that looks like markup or a link leaves it as text
await paste(null, '[x](javascript:window.injected=24) ');
await h.wait('document.querySelector("#doc-visual .ProseMirror").textContent.includes("window.injected=25")');
const plain = await h.inert();
assert.deepEqual([plain.bad, plain.handlers, plain.fetched, plain.injected], [[], 0, [], null]);
assert.ok(!plain.links.some(l => /javascript/i.test(l[0])));
// what the save writes holds no live script, frame or image from the paste: only text, escaped
await h.answer({ status: 200, body: { path: 'docs/mix.md', commit: C2, at: '2026-10-16T01:00:00Z' } });
await h.save();
const [{ content }] = await h.saved();
// A bracket that survives is escaped (`\<`), so it is text on the next load. A link or image survives only with a
// target the gate accepts: the two links and the one https image the paste carried (written as text, never
// fetched), and no javascript: or data: target anywhere.
assert.doesNotMatch(content.replace(/\\ m[1]).sort(), ['../docs/rel.md', 'https://ok.example/p', 'https://tracker.example/q.png']);
assert.doesNotMatch(content, /(? { const p = [...document.querySelectorAll('#doc-visual .ProseMirror p')].find(e => e.textContent === 'First para.');
p.parentElement.focus(); const r = document.createRange(); r.setStart(p.firstChild, 0); r.setEnd(p.firstChild, 5); const s = getSelection(); s.removeAllRanges(); s.addRange(r); return true; })()`);
await h.wait('(() => { const s = getSelection(); return s.toString() === "First"; })()');
await h.q('document.querySelector(".ed-btn[data-cmd=link]").click(), true');
await h.wait('!document.querySelector(".ed-linkbar").hidden');
const setLink = async target => {
await h.q(`(() => { const i = document.querySelector('.ed-link-input'); i.value = ${JSON.stringify(target)}; i.form.requestSubmit(); return true; })()`);
};
for (const bad of ['javascript:window.injected=30', 'JaVaScRiPt:window.injected=31', 'data:text/html,x', ' javascript:x', '//evil.example/x', 'vbscript:x', 'https://a b.example/']) {
await setLink(bad);
await h.wait('document.querySelector(".ed-link-note").textContent.includes("not allowed")');
assert.equal(await h.q('document.querySelectorAll("#doc-visual .ProseMirror a").length'), 0, `${bad} made no link`);
assert.equal(await h.q('document.querySelector(".ed-linkbar").hidden'), false, 'the bar stays open and says why');
await h.q('document.querySelector(".ed-link-note").textContent = "", true');
}
await setLink('https://ok.example/page');
await h.wait('document.querySelectorAll("#doc-visual .ProseMirror a").length === 1');
assert.deepEqual(await h.q('[...document.querySelectorAll("#doc-visual .ProseMirror a")].map(a => [a.getAttribute("href"), a.getAttribute("rel"), a.getAttribute("target"), a.textContent])'),
[['https://ok.example/page', 'noopener noreferrer', '_blank', 'First']]);
await h.quiet();
});
});
// Under Chromium 156 the paste raises one script-src-attr report per handler from the parse into prosemirror-view's
// detached document, and the page record sets those aside (STUB). A handler on the live page must still fail quiet(): one
// set on a paragraph in the editor and clicked, one parsed into an element the page owns but never attaches, one that
// prosemirror-view itself sets on an editor it draws, so that report names editor.js at another line, and one parsed into
// an element the page attaches and takes off again in the same turn. Each also says whether the page's MutationObserver
// saw the handler enter the page (window.__live): it must for all but the element never attached, or quiet() could not
// catch a pasted handler that was attached and removed before its CSP report was sent.
test('after a hostile paste, an inline handler on the live page still fails the quiet check', { timeout: 120000 }, async () => {
await session(async h => {
await h.open('docs/mix.md');
await h.pm();
const HTML = 'pasted
a b
' +
'x '; document.body.appendChild(d); d.remove(); return true; })()`, true],
];
for (const [what, expr, entered] of LIVE) {
const aside = await h.q('window.__cspInert.length');
await h.q('window.__csp = [], window.__live = [], true');
await h.q(expr);
// the one report comes when the attribute is set (Chromium 156) or when the handler would fire (earlier releases)
await h.wait(`window.__csp.length + window.__cspInert.length > ${aside}`);
await assert.rejects(h.quiet(), e => { assert.deepEqual(e.actual, { csp: ['script-src-attr inline'], errors: [], rejections: [], injected: null }, what); return true; }, what);
assert.equal(await h.q('window.__cspInert.length'), aside, `${what}: nothing set aside`);
assert.equal(await h.q('window.__live.length > 0'), entered, `${what}: ${entered ? 'seen' : 'not seen'} entering the page`);
}
});
});
// Mos's text said an image becomes text; this row also gates a pasted image span (span.md-image[data-src], the editor's own
// copy format) on the link gate, so a target the gate refuses never becomes an image node, and none can reach a save.
test('a pasted image span is kept only for a target the link gate accepts, and a save writes only those', { timeout: 120000 }, async () => {
await session(async h => {
await h.open('docs/mix.md');
await h.pm();
const ACCEPTED = [['a', 'https://ok.example/a.png'], ['r', '../img/r.png']];
const REFUSED = ['data:image/png;base64,AAAA', 'javascript:window.injected=40', '//evil.example/i.png', ' javascript:window.injected=41', 'vbscript:x', 'https://a b.example/i.png', 'DATA:image/gif;base64,AAAA'];
const HTML = [...ACCEPTED.map(([alt, src]) => `kept-${alt} x
`),
...REFUSED.map((src, i) => `refused-${i} x
`)].join('');
await h.q(`(() => {
const p = document.querySelector('#doc-visual .ProseMirror'); p.focus();
getSelection().selectAllChildren(p); getSelection().collapseToEnd();
const dt = new DataTransfer(); dt.setData('text/html', ${JSON.stringify(HTML)});
p.dispatchEvent(new ClipboardEvent('paste', { clipboardData: dt, bubbles: true, cancelable: true }));
return true; })()`);
await h.wait(`document.querySelector("#doc-visual .ProseMirror").textContent.includes("refused-${REFUSED.length - 1}")`);
// in the editor: an image node for each accepted target, drawn as text, and for no refused one
const atoms = await h.q('[...document.querySelectorAll("#doc-visual .ProseMirror .md-image")].map(e => [e.getAttribute("data-src"), e.getAttribute("data-alt"), e.localName, e.textContent])');
assert.deepEqual(atoms.map(a => a.slice(0, 3)), ACCEPTED.map(([alt, src]) => [src, alt, 'span']), 'image nodes for the accepted targets only');
assert.deepEqual(atoms.map(a => a[3]), ACCEPTED.map(([alt, src]) => `[image: ${alt}] ${src}`), 'drawn as text');
const refusedText = await h.q('document.querySelector("#doc-visual .ProseMirror").textContent');
for (let i = 0; i < REFUSED.length; i++) assert.ok(refusedText.includes(`refused-${i}`), `the text around refused target ${i} is kept`);
for (const src of REFUSED) assert.ok(!refusedText.includes(src.trim()), `${src} is nowhere in the editor`);
const view = await h.inert();
assert.deepEqual([view.bad, view.handlers, view.hrefs, view.fetched, view.injected], [[], 0, 0, [], null]);
// a save: an image for each accepted target, written as markdown, and no refused target anywhere
await h.answer({ status: 200, body: { path: 'docs/mix.md', commit: C2, at: '2026-10-16T01:00:00Z' } });
await h.save();
const [{ content }] = await h.saved();
assert.deepEqual([...content.matchAll(/!\[([^\]]*)\]\(([^)\s]*)\)/g)].map(m => [m[1], m[2]]), ACCEPTED, 'saved images: the accepted targets, in order');
for (const src of REFUSED) assert.ok(!content.includes(src.trim()), `${src} is not in the saved file`);
assert.doesNotMatch(content, /javascript:|vbscript:|data:image|evil\.example/i);
for (let i = 0; i < REFUSED.length; i++) assert.ok(content.includes(`refused-${i}`), `the text around refused target ${i} is saved as text`);
await h.quiet();
});
});
// A switch of view reuses the draft it holds; everything else that opens a file still reads it, once each.
test('a switch of view reads nothing; a reload, and a trip away and back, each read the file exactly once', { timeout: 120000 }, async () => {
await session(async h => {
const settle = () => h.q('new Promise(r => setTimeout(r, 300)).then(() => true)');
const mix = () => h.reads.filter(p => p === 'docs/mix.md').length;
await h.open('docs/mix.md');
await h.pm();
// a cold load renders twice (the page draws again when /api/config answers), so count from what opening cost
await settle();
const opened = mix();
assert.ok(opened >= 1, 'opening reads the file');
for (let i = 0; i < 2; i++) {
await h.q('document.querySelector("#doc-mode-source").click(), true');
await h.wait('document.querySelector("#doc-text")');
await h.q('document.querySelector("#doc-mode-visual").click(), true');
await h.pm();
}
await settle();
assert.equal(mix(), opened, 'two round trips between the views read nothing');
// Reload from the project: one read, and a switch after it reads nothing more
await h.q('document.querySelector("#doc-reload").click(), true');
await h.wait('document.querySelector("#doc-commit") && !document.querySelector("#bus-view [aria-busy]")');
await h.pm();
await settle();
assert.equal(mix(), opened + 1, 'Reload reads once');
await h.q('document.querySelector("#doc-mode-source").click(), true');
await h.wait('document.querySelector("#doc-text")');
await settle();
assert.equal(mix(), opened + 1, 'a switch after Reload reads nothing');
// away and back: the draft is clean, so opening the file again reads it once
await h.q('location.hash = "#/docs", true');
await h.wait('document.querySelector("#bus-view h1")?.textContent === "Docs" && !document.querySelector("#bus-view [aria-busy]")');
await h.open('docs/mix.md');
await settle();
assert.equal(mix(), opened + 2, 'going away and back reads once');
await h.quiet();
});
});
test('an edit rewrites only the block touched; a save sends the rest byte for byte; the Source view carries the draft',{ timeout: 120000 }, async () => {
await session(async h => {
await h.open('docs/mix.md');
await h.pm();
assert.equal(await h.q('document.querySelector("#doc-save").disabled'), true, 'open with no edit: nothing to save');
// a table is drawn as a tinted source block, not a table
assert.equal(await h.q('document.querySelectorAll("#doc-visual .ProseMirror table").length'), 0);
assert.equal(await h.q('document.querySelectorAll("#doc-visual .ProseMirror pre.md-raw").length'), 1);
// type at the end of the first paragraph
await h.q(`(() => { const p = [...document.querySelectorAll('#doc-visual .ProseMirror p')].find(e => e.textContent === 'First para.');
p.parentElement.focus(); const r = document.createRange(); r.setStart(p.firstChild, p.firstChild.length); r.collapse(true); const s = getSelection(); s.removeAllRanges(); s.addRange(r); return true; })()`);
await h.b.call('Input.insertText', { text: ' More **not bold**.' });
await h.wait('!document.querySelector("#doc-save").disabled');
// Save is on because the draft differs, so the editor must hold the typed text, and keep holding it until the click.
const typed = () => h.q('document.querySelector("#doc-visual .ProseMirror").textContent');
assert.ok((await typed()).includes('First para. More **not bold**.'), 'the typed text is in the editor');
await h.q('new Promise(r => setTimeout(r, 300)).then(() => true)');
assert.equal(await h.q('document.querySelector("#doc-save").disabled'), false, 'Save stays on');
assert.ok((await typed()).includes('First para. More **not bold**.'), 'the typed text is still in the editor');
await h.answer({ status: 200, body: { path: 'docs/mix.md', commit: C2, at: '2026-10-16T01:00:00Z' } });
await h.save();
const [sent] = await h.saved();
assert.deepEqual(Object.keys(sent).sort(), ['base', 'content', 'path', 'project'], 'the body row 148 sends');
assert.deepEqual([sent.project, sent.path, sent.base], ['stack', 'docs/mix.md', C1]);
// the typed `**` is text, so it is escaped; the table, the heading and the last paragraph are untouched
assert.equal(sent.content, '# Title\n\nFirst para. More \\*\\*not bold\\*\\*.\n\n| a | b |\n|---|---|\n| 1 | 2 |\n\nLast para.\n');
assert.equal(await h.q('document.querySelector("#doc-save").disabled'), true, 'saved, so nothing left to save');
// the Source view shows the draft as the editor would save it, with no new read of the project, and an edit there
// comes back to the visual view
const readsBefore = h.reads.length;
await h.q('document.querySelector("#doc-mode-source").click(), true');
await h.wait('document.querySelector("#doc-text")');
assert.equal(await h.q('document.querySelector("#doc-text").value'), sent.content);
assert.equal(h.reads.length, readsBefore, 'a switch of view reads nothing');
await h.q(`(() => { const t = document.querySelector('#doc-text'); t.value = t.value.replace('Last para.', 'Final para.'); t.dispatchEvent(new Event('input', { bubbles: true })); return true; })()`);
await h.q('document.querySelector("#doc-mode-visual").click(), true');
await h.pm();
assert.ok((await h.q('document.querySelector("#doc-visual .ProseMirror").textContent')).includes('Final para.'));
assert.equal(await h.q('document.querySelector("#doc-save").disabled'), false);
assert.equal(h.reads.length, readsBefore, 'the switch back reads nothing either');
// toolbar and keys: bold with the key, a heading from the toolbar, a list from the markdown shortcut
await h.q(`(() => { const p = [...document.querySelectorAll('#doc-visual .ProseMirror p')].find(e => e.textContent === 'Final para.');
p.parentElement.focus(); const r = document.createRange(); r.setStart(p.firstChild, 0); r.setEnd(p.firstChild, 5); const s = getSelection(); s.removeAllRanges(); s.addRange(r); return true; })()`);
await h.wait('getSelection().toString() === "Final"');
await h.q('document.querySelector(".ed-btn[data-cmd=strong]").click(), true');
await h.wait('document.querySelectorAll("#doc-visual .ProseMirror strong").length === 1');
await h.q('document.querySelector(".ed-btn[data-cmd=h2]").click(), true');
await h.wait('document.querySelectorAll("#doc-visual .ProseMirror h2").length === 1');
await h.answer({ status: 200, body: { path: 'docs/mix.md', commit: '3'.repeat(40), at: '2026-10-16T02:00:00Z' } });
await h.save();
const second = (await h.saved())[1];
assert.equal(second.content, '# Title\n\nFirst para. More \\*\\*not bold\\*\\*.\n\n| a | b |\n|---|---|\n| 1 | 2 |\n\n## **Final** para.\n');
assert.equal(second.base, C2, 'the second save is based on the commit the first one made');
await h.quiet();
});
});
test('a file the editor cannot write back byte for byte opens as Source, says so, cannot save, and the Visual button works once it can', { timeout: 120000 }, async () => {
await session(async h => {
const settle = () => h.q('new Promise(r => setTimeout(r, 300)).then(() => true)');
const shown = () => h.q(`({ pm: !!document.querySelector('#doc-visual .ProseMirror'), text: document.querySelector('#doc-text')?.value ?? null,
note: document.querySelector('#bus-view')?.textContent.includes('The visual editor is not available for this file, so it is open as source.'),
pressed: [document.querySelector('#doc-mode-visual')?.getAttribute('aria-pressed'), document.querySelector('#doc-mode-source')?.getAttribute('aria-pressed')],
saveOff: document.querySelector('#doc-save')?.disabled })`);
const reload = async () => { await h.q('document.querySelector("#doc-reload").click(), true'); await h.wait('document.querySelector("#doc-commit")?.textContent !== "" && !document.querySelector("#bus-view [aria-busy]")'); await settle(); };
await h.open('docs/mix.md');
await h.pm();
assert.deepEqual((await shown()).pressed, ['true', 'false'], 'a plain file opens in the visual editor');
// roundTrip disagrees with the file: the gate refuses, whatever else the editor could do
await h.q(`(() => { const real = window.MosaicEditor; window.__rt = false; window.MosaicEditor = { mount: real.mount, roundTrip: t => window.__rt ? real.roundTrip(t) : t + ' ' }; return true; })()`);
await reload();
assert.deepEqual(await shown(), { pm: false, text: MIX, note: true, pressed: ['false', 'true'], saveOff: true }, 'a failed round trip shows the source, the note and a Save that is off');
// the screen shows Source, so the Visual button must act: once the file round-trips it opens the editor with no new read
await h.q('window.__rt = true, true');
const reads = h.reads.length;
await h.q('document.querySelector("#doc-mode-visual").click(), true');
await h.pm();
assert.deepEqual((await shown()).pressed, ['true', 'false'], 'Visual works from a fallback');
assert.equal(h.reads.length, reads, 'the switch reads nothing');
// the preference is not lost: the next fallback is a fallback again, not the Source the user never picked
await h.q('window.__rt = false, true');
await reload();
assert.equal((await shown()).pm, false);
// no editor script at all: the same page, the same note
await h.q('window.MosaicEditor = undefined, true');
await reload();
assert.deepEqual(await shown(), { pm: false, text: MIX, note: true, pressed: ['false', 'true'], saveOff: true }, 'without window.MosaicEditor the page is Source with the note');
await h.q('document.querySelector("#doc-mode-visual").click(), true');
await settle();
assert.deepEqual(await shown(), { pm: false, text: MIX, note: true, pressed: ['false', 'true'], saveOff: true }, 'Visual with no editor stays Source');
await h.quiet();
});
});
// Dewey's r1 finding: a link title, an image alt or title and a code block's info string are written into one line of
// Markdown, a paste can set any of them, and a line break in one saved a raw HTML block. Each of the four, on the paste path.
// (The editor's own reading of a file can give a single line break in a title or alt, never a blank line; see BUILD.md.)
const BREAK = 'T\n\n comes between two paragraphs:
// prosemirror-view opens the first and last node of a pasted slice (Slice.maxOpen), so a lone joins the block the
// cursor is in as plain text and sets no params; the paste here lands in the first block, the heading.
const attrOf = v => v.replace(/&/g, '&').replace(/"/g, '"');
// One paste, then Save: `value` is what the pasted node must hold in the document, `written` what the file must then contain.
// With `reread`, the saved text is also opened by the editor's own reader (a second, read-only mount): the title must come
// back as pasted and no tag may have come out as text of the document, which is what a renderer with raw HTML would run.
function pasteTest(name, html, value, written, node, attr, headline = `${name} pasted with line breaks in it is written on one line, so no HTML block comes of it`, reread = false) {
test(headline, { timeout: 120000 }, async () => {
await session(async h => {
await h.open('docs/mix.md');
await h.pm();
await h.q(`(() => {
const p = document.querySelector('#doc-visual .ProseMirror'); p.focus();
getSelection().selectAllChildren(p); getSelection().collapseToEnd();
const dt = new DataTransfer(); dt.setData('text/html', ${JSON.stringify(html)});
p.dispatchEvent(new ClipboardEvent('paste', { clipboardData: dt, bubbles: true, cancelable: true }));
return true; })()`);
const sel = `#doc-visual .ProseMirror ${node}[${attr}]`;
await h.wait(`document.querySelector(${JSON.stringify(sel)})`);
assert.equal(await h.q(`document.querySelector(${JSON.stringify(sel)}).getAttribute(${JSON.stringify(attr)})`), value, 'the pasted node holds the hostile value in the document');
await h.wait('!document.querySelector("#doc-save").disabled');
await h.answer({ status: 200, body: { path: 'docs/mix.md', commit: C2, at: '2026-10-16T01:00:00Z' } });
await h.save();
const [{ content }] = await h.saved();
assert.ok(content.includes(written), `the value is written as ${JSON.stringify(written)} in ${JSON.stringify(content)}`);
assert.doesNotMatch(content, /^[ \t]*word `, '[word](https://ok.example/p "T x
`, '![T x
`, '![a](https://ok.example/a.png "T x
code y
`, '```T\ncode\n```', 'pre[data-params]', 'data-params'],
]) pasteTest(name, html, BREAK, written, node, attr);
// Dewey's r2 finding: the title writers escaped `"` and not `\`. A title `x\") word
`, value, `[word](https://ok.example/p "${written}")`, 'a[href="https://ok.example/p"]', 'title',
`a link title holding ${what} is written with the backslash escaped, so the title stays closed`, true);
pasteTest('an image title', `x
`, value, ``, 'span.md-image', 'data-title',
`an image title holding ${what} is written with the backslash escaped, so the title stays closed`, true);
}
// Filbert's g5: a backtick in a code block's info string ends the fence if written; the load side refuses it first (tilde
// fence, below), so only a paste reaches the save side.
pasteTest('a code block info string', 'x
code y
', 'a`b', '```\ncode\n```', 'pre[data-params]', 'data-params',
'a code block info string with a backtick, pasted, is dropped on Save, so the fence stays closed');
test('a code block info string with a backtick, as a tilde fence can have, is kept as source, not rewritten without it', { timeout: 120000 }, async () => {
await session(async h => {
await h.open('docs/tilde.md');
await h.pm();
assert.equal(await h.q('document.querySelectorAll("#doc-visual .ProseMirror pre.md-raw").length'), 1, 'the block is a source block');
assert.ok((await h.q('document.querySelector("#doc-visual .ProseMirror pre.md-raw").textContent')).startsWith('~~~a`b'));
await h.quiet();
});
});