blob: c8180ce91922201452c30bcd9296f37a07d4f9ed [file] [log] [blame]
>>> image
![](http://foo.com/foo.png)
<<<
<p><img src="http://foo.com/foo.png" alt="" /></p>
>>> alternate text
![alternate text](http://foo.com/foo.png)
<<<
<p><img src="http://foo.com/foo.png" alt="alternate text" /></p>
>>> title
![](http://foo.com/foo.png "optional title")
<<<
<p><img src="http://foo.com/foo.png" alt="" title="optional title" /></p>
>>> invalid alt text
![`alt`](http://foo.com/foo.png)
<<<
<p><img src="http://foo.com/foo.png" alt="alt" /></p>
>>> XSS
![Uh oh...]("onerror="alert('XSS'))
<<<
<p><img src="%22onerror=%22alert('XSS')" alt="Uh oh..." /></p>
>>> URL-escaping should be left alone inside the destination
![](https://example/foo%2Fvar)
<<<
<p><img src="https://example/foo%2Fvar" alt="" /></p>