1package devtools23import (4 "testing"5)67// zwBlank holds one input per rune range chain/markdown.StripBidiAndZeroWidth8// removes (U+200B..U+200F, U+202A..U+202E, U+2066..U+2069, U+FEFF), plus a mix9// with real spaces. strings.TrimSpace keeps every one of them and the render10// strips them all, so each must be refused.11var zwBlank = []string{12 "\u200b\u200b\u200b", // ZWSP13 "\u200d", // ZWJ14 "\u200e", // LRM15 "\u202e", // RLO16 "\u2066\u2069", // LRI PDI17 "\ufeff", // BOM18 " \u200b \u200b ", // mixed with real spaces19}2021// zwOK must stay accepted: the stripper removes the marks and leaves text.22var zwOK = []string{"a", "a\u200bb", " padded "}2324func TestZeroWidthNoteIsRefused(cur realm, t *testing.T) {25 // Reset, not reset: the author board is what ExampleRender would see.26 Reset(cross(cur))27 for _, s := range zwBlank {28 if revive(func() { Add(cross(cur), s) }) == nil {29 t.Errorf("Add accepted note %q, which is stored escaped as blank", s)30 }31 }32 for _, s := range zwOK {33 if r := revive(func() { Add(cross(cur), s) }); r != nil {34 t.Errorf("Add refused note %q: %v", s, r)35 }36 }37 if notes.Size() != len(zwOK) {38 t.Errorf("%d note(s), want %d", notes.Size(), len(zwOK))39 }40 // Not deferred: a crossing call cannot be.41 Reset(cross(cur))42}43Add(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, body string)
Render(path string) string
Reset(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string})
Signatures reconstructed verbatim from vm/qfuncs — interface params keep their inline definitions.
vm/qrender output, sanitized (docs/render-security.md) and displayed in an empty-sandbox iframe — scripts, forms and popups cannot run. Links stay inert in-preview; right-click to open.