feat(cv-import): add source-grounded review and explicit corrections

tools/summarizer/tests/test_document_extractor.py

@@ -11,6 +11,7 @@ from pathlib import Path
 import pytest
 from docx import Document
 from pypdf import PdfWriter
+from pypdf.annotations import Link
 from pypdf.generic import DecodedStreamObject, DictionaryObject, NameObject, TextStringObject
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
@@ -103,6 +104,30 @@ def test_docx_rejects_external_relationships():
     assert failure.value.code == "external_content"
 
 
+def test_docx_allows_inert_hyperlinks_without_network_access():
+    payload = io.BytesIO()
+    with zipfile.ZipFile(io.BytesIO(docx_bytes())) as source, zipfile.ZipFile(payload, "w", zipfile.ZIP_DEFLATED) as output:
+        for entry in source.infolist():
+            body = source.read(entry)
+            if entry.filename == "word/_rels/document.xml.rels":
+                body = body.replace(b"</Relationships>", b'<Relationship Id="safe-link" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink" TargetMode="External" Target="https://portfolio.example.test"/></Relationships>')
+            output.writestr(entry.filename, body)
+    assert parser_child.extract_document(".docx", payload.getvalue())["method"] == "docling-docx-v1"
+
+
+def test_pdf_allows_inert_web_links_but_rejects_script_links():
+    for target, allowed in [("https://portfolio.example.test", True), ("javascript:alert(1)", False)]:
+        writer = PdfWriter(clone_from=io.BytesIO(pdf_bytes()))
+        writer.add_annotation(page_number=0, annotation=Link(rect=(40, 700, 200, 720), url=target))
+        output = io.BytesIO()
+        writer.write(output)
+        if allowed:
+            assert parser_child.extract_document(".pdf", output.getvalue())["method"] == "docling-native-pdf-v1"
+        else:
+            with pytest.raises(parser_child.ParserError):
+                parser_child.extract_document(".pdf", output.getvalue())
+
+
 def test_docx_rejects_archive_traversal():
     payload = io.BytesIO()
     with zipfile.ZipFile(io.BytesIO(docx_bytes())) as source, zipfile.ZipFile(payload, "w", zipfile.ZIP_DEFLATED) as output: