David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keep link-label rendering compatible with the autolink source guard

Browse source
This commit is contained in:
Rod Boev 2026-06-11 19:08:28 -04:00
parent 12e13d4680
commit 22f9e5c973
1 changed files with 17 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
static/ui.js
View file

@ -3530,21 +3530,6 @@ function renderMd(raw){
// Inline backtick spans: restore <code> tags produced in the stash callback above.
// Must happen BEFORE bold/italic so **`code`** → <strong><code>code</code></strong>.
s=s.replace(/\x00F(\d+)\x00/g,(_,i)=>fence_stash[+i]);
const SAFE_LABEL_INLINE=/^<\/?(strong|em|del|code)([\s>]|$)/i;
function _markdownLabelHtml(label){
const _label_stash=[];
const tokenized=String(label||'').replace(/<\/?[a-z][^>]*>/gi,tag=>{
if(!SAFE_LABEL_INLINE.test(tag)) return tag;
_label_stash.push(tag);
return `\x00H${_label_stash.length-1}\x00`;
});
return esc(tokenized).replace(/\x00H(\d+)\x00/g,(_,i)=>_label_stash[+i]);
}
function _markdownAnchor(label,rawUrl){
const href=_markdownHref(rawUrl);
const internal=/^session:\/\//i.test(String(rawUrl||'')) || _isInternalSessionHref(href);
return `<a${internal?' class="session-link"':''} href="${href}"${internal?'':' target="_blank" rel="noopener"'}>${_markdownLabelHtml(label)}</a>`;
}
// inlineMd: process bold/italic/code/links within a single line of text.
// Used inside list items and blockquotes where the text may already contain
// HTML from the pre-pass → bold pipeline, so we cannot call esc() directly.
@ -3772,6 +3757,23 @@ function renderMd(raw){
return false;
}
}
function _isSafeLabelInline(tag){
return /^<\/?(strong|em|del|code)([\s>]|$)/i.test(tag);
}
function _markdownLabelHtml(label){
const _label_stash=[];
const tokenized=String(label||'').replace(/<\/?[a-z][^>]*>/gi,tag=>{
if(!_isSafeLabelInline(tag)) return tag;
_label_stash.push(tag);
return `\x00H${_label_stash.length-1}\x00`;
});
return esc(tokenized).replace(/\x00H(\d+)\x00/g,(_,i)=>_label_stash[+i]);
}
function _markdownAnchor(label,rawUrl){
const href=_markdownHref(rawUrl);
const internal=/^session:\/\//i.test(String(rawUrl||'')) || _isInternalSessionHref(href);
return `<a${internal?' class="session-link"':''} href="${href}"${internal?'':' target="_blank" rel="noopener"'}>${_markdownLabelHtml(label)}</a>`;
}
function _isSafeUrl(v, img){
const raw=_safeAttrValue(v);
const compact=raw.replace(/[\u0000-\u001f\u007f\s]+/g,'').toLowerCase();