"""Forum emoji: self-hosted Twemoji images, shortcodes, and no way to turn user text into markup.""" import forum import forum_emoji def html(text): return str(forum.render_body(text)) def test_unicode_emoji_become_self_hosted_images(): out = html("found one \U0001F680") assert ':rocket: \U0001F680" in out def test_escaping_still_holds_around_emoji(): out = html(' \U0001F680 :rocket:') assert "onerror" not in out.replace("<img src=x onerror=alert(1)>", "") assert str(forum.emojify_text("\U0001F680")).startswith("<b>