David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#4001): preserve inline code inside markdown link labels

Browse source
This commit is contained in:
Rod Boev 2026-06-11 18:50:54 -04:00
parent 8669b6b8b5
commit e3765a389c
2 changed files with 33 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
static/ui.js
View file

@ -3757,10 +3757,20 @@ function renderMd(raw){
return false;
}
}
const SAFE_LABEL_INLINE=/^<\/?(strong|em|del|code)([\s>]|$)/i;
function _markdownLabelHtml(label){
const _label_stash=[];
const tokenized=String(label||'').replace(/<\/?[a-z][^>]*>/gi,tag=>{
if(!SAFE_LABEL_INLINE.test(tag)) return tag;
_label_stash.push(tag);
return `\x00H${_label_stash.length-1}\x00`;
});
return esc(tokenized).replace(/\x00H(\d+)\x00/g,(_,i)=>_label_stash[+i]);
}
function _markdownAnchor(label,rawUrl){
const href=_markdownHref(rawUrl);
const internal=/^session:\/\//i.test(String(rawUrl||'')) || _isInternalSessionHref(href);
return `<a${internal?' class="session-link"':''} href="${href}"${internal?'':' target="_blank" rel="noopener"'}>${esc(label)}</a>`;
return `<a${internal?' class="session-link"':''} href="${href}"${internal?'':' target="_blank" rel="noopener"'}>${_markdownLabelHtml(label)}</a>`;
}
function _isSafeUrl(v, img){
const raw=_safeAttrValue(v);

22
tests/test_issue4001_inline_code_link_label.py Normal file
View file

@ -0,0 +1,22 @@
from tests.test_renderer_js_behaviour import _render, driver_path # noqa: F401
def test_inline_code_inside_link_label_renders_as_code(driver_path):
out = _render(driver_path, "[`8c64957`](https://github.com/x/y)")
assert '<a href="https://github.com/x/y"' in out
assert "<code>8c64957</code>" in out
assert "&lt;code&gt;" not in out
def test_list_item_link_label_keeps_inline_code(driver_path):
out = _render(driver_path, "- [`8c64957`](https://github.com/x/y)")
assert "<li>" in out
assert "<code>8c64957</code>" in out
assert "&lt;code&gt;" not in out
def test_unknown_raw_html_inside_link_label_is_escaped_once(driver_path):
out = _render(driver_path, "[<script>alert(1)</script>](https://github.com/x/y)")
assert "<script>" not in out
assert "&lt;script&gt;alert(1)&lt;/script&gt;" in out
assert "&amp;lt;script" not in out