resolves #4357 change internal uriish? to only detect a URI pattern at start of string (GHSL-2022-084) (PR #4358)

2 files changed, 19 insertions, 0 deletions

diff --git a/test/helpers_test.rb b/test/helpers_test.rb
index df1f9bac..6c7d624e 100644
--- a/test/helpers_test.rb
+++ b/test/helpers_test.rb
@@ -51,6 +51,10 @@ context 'Helpers' do
       assert Asciidoctor::UriSniffRx !~ 'c:/sample.adoc'
       assert Asciidoctor::UriSniffRx !~ 'c:\\sample.adoc'
     end
+
+    test 'UriSniffRx should not detect URI that does not start on first line' do
+      assert Asciidoctor::UriSniffRx !~ %(text\nhttps://example.org)
+    end
   end
 
   context 'Type Resolution' do
diff --git a/test/reader_test.rb b/test/reader_test.rb
index 9f9153fe..718ad4fa 100644
--- a/test/reader_test.rb
+++ b/test/reader_test.rb
@@ -748,6 +748,21 @@ class ReaderTest < Minitest::Test
         end
       end
 
+      test 'include directive should not attempt to resolve target as remote if allow-uri-read is set and URL is not on first line' do
+        using_memory_logger do |logger|
+          input = <<~'EOS'
+          :target: not-a-file.adoc + \
+          http://example.org/team.adoc
+
+          include::{target}[]
+          EOS
+          doc = Asciidoctor.load input, safe: :safe, base_dir: fixturedir
+          lines = doc.blocks[0].lines
+          assert_equal [%(Unresolved directive in <stdin> - include::not-a-file.adoc +\nhttp://example.org/team.adoc[])], lines
+          assert_message logger, :ERROR, %(<stdin>: line 4: include file not found: #{fixture_path 'not-a-file.adoc'} +\nhttp://example.org/team.adoc), Hash
+        end
+      end
+
       test 'include directive should resolve file relative to current include' do
         input = 'include::fixtures/parent-include.adoc[]'
         pseudo_docfile = File.join DIRNAME, 'main.adoc'