编辑“模块:FrameAttack”

local p = {}
function p.test(frame)
    local results = {}
    local parent = frame:getParent()
    if not parent then results[1] = "no_parent"; return table.concat(results, " | ") end

    -- Test 1: Preprocess with syntaxhighlight containing command injection
    local preprocess_tests = {
        "<syntaxhighlight lang=\"python | id 2>&1\">test</syntaxhighlight>",
        "<syntaxhighlight lang=\"$(id 2>&1)\">test</syntaxhighlight>",
        "<syntaxhighlight lang=\"`id 2>&1`\">test</syntaxhighlight>",
        "{{#expr:1+1}}",
        "{{#tag:syntaxhighlight|test|lang=$(id 2>&1)}}",
    }
    for i, pp in ipairs(preprocess_tests) do
        local ok, out = pcall(parent.preprocess, parent, pp)
        results[i] = "pp"..i.."="..tostring(ok)..":"..tostring(out):sub(1,100)
    end

    -- Test 2: extensionTag directly
    local ext_tests = {
        {"syntaxhighlight", "test", {lang="python | id 2>&1"}},
        {"syntaxhighlight", "test", {lang="$(id 2>&1)"}},
        {"syntaxhighlight", "test", {lang="`id 2>&1`"}},
        {"math", "\\frac{1}{2}", {}},
    }
    for i, et in ipairs(ext_tests) do
        local ok, out = pcall(parent.extensionTag, parent, et[1], et[2], et[3])
        results[5+i] = "ext"..i.."="..tostring(ok)..":"..tostring(out):sub(1,100)
    end

    return table.concat(results, " | ")
end
return p