diff --git a/app/pkg/markdown/markdown.go b/app/pkg/markdown/markdown.go index 183028f0a..17df3839d 100644 --- a/app/pkg/markdown/markdown.go +++ b/app/pkg/markdown/markdown.go @@ -1,12 +1,13 @@ package markdown import ( - "github.com/gomarkdown/markdown" - "github.com/gomarkdown/markdown/ast" "html/template" "io" "strings" + "github.com/gomarkdown/markdown" + "github.com/gomarkdown/markdown/ast" + htmlrenderer "github.com/gomarkdown/markdown/html" mdparser "github.com/gomarkdown/markdown/parser" ) @@ -26,7 +27,10 @@ var htmlFlags = 0 | htmlrenderer.Smartypants | htmlrenderer.SmartypantsFractions | htmlrenderer.SmartypantsDashes | - htmlrenderer.SmartypantsLatexDashes + htmlrenderer.SmartypantsLatexDashes | + htmlrenderer.Safelink | + htmlrenderer.NofollowLinks | + htmlrenderer.NoreferrerLinks var fullRenderer = htmlrenderer.NewRenderer(htmlrenderer.RendererOptions{ Flags: htmlFlags, diff --git a/app/pkg/markdown/markdown_test.go b/app/pkg/markdown/markdown_test.go index 953838b11..33525ae7c 100644 --- a/app/pkg/markdown/markdown_test.go +++ b/app/pkg/markdown/markdown_test.go @@ -15,7 +15,7 @@ func TestFullMarkdown(t *testing.T) { "# Hello World": `

Hello World

`, "Hello Beautiful World": `

Hello <b>Beautiful</b> World

`, "![](http://example.com/hello.jpg)": `

`, - "Go to http://example.com/hello.jpg": `

Go to http://example.com/hello.jpg

`, + "Go to http://example.com/hello.jpg": `

Go to http://example.com/hello.jpg

`, `-123 -456 -789`: `

-123
diff --git a/locale/pl/client.json b/locale/pl/client.json index cc1606349..ee8409f03 100644 --- a/locale/pl/client.json +++ b/locale/pl/client.json @@ -150,4 +150,4 @@ "signin.message.private.text": "Jeśli posiadasz konto lub zaproszenie możesz użyć poniższych opcji aby się zalogować.", "signin.message.private.title": "<0>{0} is a private space, you must sign in to participate and vote.", "{count, plural, one {# tag} other {# tags}}": "{count, plural, one {# tag} few {# tagów} many {# tagów} other {# tagi}}" -} +} \ No newline at end of file diff --git a/public/services/markdown.spec.ts b/public/services/markdown.spec.ts index 1c8d4e1e4..b425236d0 100644 --- a/public/services/markdown.spec.ts +++ b/public/services/markdown.spec.ts @@ -3,7 +3,7 @@ import * as markdown from "./markdown" const testCases = [ { input: "Visit [GitHub](https://github.com) to learn more.", - expectedFull: '

Visit GitHub to learn more.

', + expectedFull: '

Visit GitHub to learn more.

', expectedPlainText: "Visit GitHub to learn more.", }, { @@ -24,7 +24,7 @@ const testCases = [ }, { input: `[Uh oh...]("onerror="alert('XSS'))`, - expectedFull: '

Uh oh...

', + expectedFull: '

Uh oh...

', expectedPlainText: "Uh oh...", }, { diff --git a/public/services/markdown.ts b/public/services/markdown.ts index 16d60e90f..aab88c209 100644 --- a/public/services/markdown.ts +++ b/public/services/markdown.ts @@ -20,7 +20,7 @@ if (DOMPurify.isSupported) { const link = (href: string, title: string, text: string) => { const titleAttr = title ? ` title=${title}` : "" - return `${text}` + return `${text}` } const fullRenderer = new marked.Renderer()