diff --git a/static/ui.js b/static/ui.js index ed4584f9..012a10d3 100644 --- a/static/ui.js +++ b/static/ui.js @@ -3530,21 +3530,6 @@ function renderMd(raw){ // Inline backtick spans: restore tags produced in the stash callback above. // Must happen BEFORE bold/italic so **`code`** → code. s=s.replace(/\x00F(\d+)\x00/g,(_,i)=>fence_stash[+i]); - const SAFE_LABEL_INLINE=/^<\/?(strong|em|del|code)([\s>]|$)/i; - function _markdownLabelHtml(label){ - const _label_stash=[]; - const tokenized=String(label||'').replace(/<\/?[a-z][^>]*>/gi,tag=>{ - if(!SAFE_LABEL_INLINE.test(tag)) return tag; - _label_stash.push(tag); - return `\x00H${_label_stash.length-1}\x00`; - }); - return esc(tokenized).replace(/\x00H(\d+)\x00/g,(_,i)=>_label_stash[+i]); - } - function _markdownAnchor(label,rawUrl){ - const href=_markdownHref(rawUrl); - const internal=/^session:\/\//i.test(String(rawUrl||'')) || _isInternalSessionHref(href); - return `${_markdownLabelHtml(label)}`; - } // inlineMd: process bold/italic/code/links within a single line of text. // Used inside list items and blockquotes where the text may already contain // HTML from the pre-pass → bold pipeline, so we cannot call esc() directly. @@ -3772,6 +3757,23 @@ function renderMd(raw){ return false; } } + function _isSafeLabelInline(tag){ + return /^<\/?(strong|em|del|code)([\s>]|$)/i.test(tag); + } + function _markdownLabelHtml(label){ + const _label_stash=[]; + const tokenized=String(label||'').replace(/<\/?[a-z][^>]*>/gi,tag=>{ + if(!_isSafeLabelInline(tag)) return tag; + _label_stash.push(tag); + return `\x00H${_label_stash.length-1}\x00`; + }); + return esc(tokenized).replace(/\x00H(\d+)\x00/g,(_,i)=>_label_stash[+i]); + } + function _markdownAnchor(label,rawUrl){ + const href=_markdownHref(rawUrl); + const internal=/^session:\/\//i.test(String(rawUrl||'')) || _isInternalSessionHref(href); + return `${_markdownLabelHtml(label)}`; + } function _isSafeUrl(v, img){ const raw=_safeAttrValue(v); const compact=raw.replace(/[\u0000-\u001f\u007f\s]+/g,'').toLowerCase();