diff --git a/app/pkg/markdown/markdown.go b/app/pkg/markdown/markdown.go index 183028f0a..17df3839d 100644 --- a/app/pkg/markdown/markdown.go +++ b/app/pkg/markdown/markdown.go @@ -1,12 +1,13 @@ package markdown import ( - "github.com/gomarkdown/markdown" - "github.com/gomarkdown/markdown/ast" "html/template" "io" "strings" + "github.com/gomarkdown/markdown" + "github.com/gomarkdown/markdown/ast" + htmlrenderer "github.com/gomarkdown/markdown/html" mdparser "github.com/gomarkdown/markdown/parser" ) @@ -26,7 +27,10 @@ var htmlFlags = 0 | htmlrenderer.Smartypants | htmlrenderer.SmartypantsFractions | htmlrenderer.SmartypantsDashes | - htmlrenderer.SmartypantsLatexDashes + htmlrenderer.SmartypantsLatexDashes | + htmlrenderer.Safelink | + htmlrenderer.NofollowLinks | + htmlrenderer.NoreferrerLinks var fullRenderer = htmlrenderer.NewRenderer(htmlrenderer.RendererOptions{ Flags: htmlFlags, diff --git a/app/pkg/markdown/markdown_test.go b/app/pkg/markdown/markdown_test.go index 953838b11..33525ae7c 100644 --- a/app/pkg/markdown/markdown_test.go +++ b/app/pkg/markdown/markdown_test.go @@ -15,7 +15,7 @@ func TestFullMarkdown(t *testing.T) { "# Hello World": `
Hello <b>Beautiful</b> World
`, "![](http://example.com/hello.jpg)": ``, - "Go to http://example.com/hello.jpg": `Go to http://example.com/hello.jpg
`, + "Go to http://example.com/hello.jpg": `Go to http://example.com/hello.jpg
`, `-123 -456 -789`: `-123
diff --git a/locale/pl/client.json b/locale/pl/client.json
index cc1606349..ee8409f03 100644
--- a/locale/pl/client.json
+++ b/locale/pl/client.json
@@ -150,4 +150,4 @@
"signin.message.private.text": "Jeśli posiadasz konto lub zaproszenie możesz użyć poniższych opcji aby się zalogować.",
"signin.message.private.title": "<0>{0}0> is a private space, you must sign in to participate and vote.",
"{count, plural, one {# tag} other {# tags}}": "{count, plural, one {# tag} few {# tagów} many {# tagów} other {# tagi}}"
-}
+}
\ No newline at end of file
diff --git a/public/services/markdown.spec.ts b/public/services/markdown.spec.ts
index 1c8d4e1e4..b425236d0 100644
--- a/public/services/markdown.spec.ts
+++ b/public/services/markdown.spec.ts
@@ -3,7 +3,7 @@ import * as markdown from "./markdown"
const testCases = [
{
input: "Visit [GitHub](https://github.com) to learn more.",
- expectedFull: '
Visit GitHub to learn more.
', + expectedFull: 'Visit GitHub to learn more.
', expectedPlainText: "Visit GitHub to learn more.", }, { @@ -24,7 +24,7 @@ const testCases = [ }, { input: `[Uh oh...]("onerror="alert('XSS'))`, - expectedFull: '', + expectedFull: '', expectedPlainText: "Uh oh...", }, { diff --git a/public/services/markdown.ts b/public/services/markdown.ts index 16d60e90f..aab88c209 100644 --- a/public/services/markdown.ts +++ b/public/services/markdown.ts @@ -20,7 +20,7 @@ if (DOMPurify.isSupported) { const link = (href: string, title: string, text: string) => { const titleAttr = title ? ` title=${title}` : "" - return `${text}` + return `${text}` } const fullRenderer = new marked.Renderer()