|
@@ -9,8 +9,6 @@ var Markdown = require('markdown-it')({
|
|
|
|
|
|
import markdownItMermaid from "@wekanteam/markdown-it-mermaid";
|
|
import markdownItMermaid from "@wekanteam/markdown-it-mermaid";
|
|
|
|
|
|
-/*
|
|
|
|
-
|
|
|
|
// Static URL Scheme Listing
|
|
// Static URL Scheme Listing
|
|
var urlschemes = [
|
|
var urlschemes = [
|
|
"aodroplink",
|
|
"aodroplink",
|
|
@@ -23,74 +21,20 @@ var urlschemes = [
|
|
"mailspring"
|
|
"mailspring"
|
|
];
|
|
];
|
|
|
|
|
|
|
|
+
|
|
|
|
+
|
|
// Better would be a field in the admin backend to set this dynamically
|
|
// Better would be a field in the admin backend to set this dynamically
|
|
// instead of putting all known or wanted url schemes here hard into code
|
|
// instead of putting all known or wanted url schemes here hard into code
|
|
// but i was not able to access those settings
|
|
// but i was not able to access those settings
|
|
// var urlschemes = currentSetting.automaticLinkedUrlSchemes.split('\n');
|
|
// var urlschemes = currentSetting.automaticLinkedUrlSchemes.split('\n');
|
|
|
|
|
|
|
|
+
|
|
|
|
+
|
|
// put all url schemes into the linkify configuration to automatically make it clickable
|
|
// put all url schemes into the linkify configuration to automatically make it clickable
|
|
for(var i=0; i<urlschemes.length;i++){
|
|
for(var i=0; i<urlschemes.length;i++){
|
|
- //console.log("adding autolink for "+urlschemes[i]);
|
|
|
|
Markdown.linkify.add(urlschemes[i]+":",'http:');
|
|
Markdown.linkify.add(urlschemes[i]+":",'http:');
|
|
}
|
|
}
|
|
|
|
|
|
-
|
|
|
|
-
|
|
|
|
-// build fitting regex
|
|
|
|
-var regex = RegExp('^(' + urlschemes.join('|') + '):', 'gim');
|
|
|
|
-
|
|
|
|
-// Add a hook to enforce URI scheme allow-list
|
|
|
|
-DOMPurify.addHook('afterSanitizeAttributes', function (node) {
|
|
|
|
- // build an anchor to map URLs to
|
|
|
|
- var anchor = document.createElement('a');
|
|
|
|
-
|
|
|
|
- // check all href attributes for validity
|
|
|
|
- if (node.hasAttribute('href')) {
|
|
|
|
- anchor.href = node.getAttribute('href');
|
|
|
|
- if (anchor.protocol && !anchor.protocol.match(regex)) {
|
|
|
|
- node.removeAttribute('href');
|
|
|
|
- }
|
|
|
|
- }
|
|
|
|
- // check all action attributes for validity
|
|
|
|
- if (node.hasAttribute('action')) {
|
|
|
|
- anchor.href = node.getAttribute('action');
|
|
|
|
- if (anchor.protocol && !anchor.protocol.match(regex)) {
|
|
|
|
- node.removeAttribute('action');
|
|
|
|
- }
|
|
|
|
- }
|
|
|
|
- // check all xlink:href attributes for validity
|
|
|
|
- if (node.hasAttribute('xlink:href')) {
|
|
|
|
- anchor.href = node.getAttribute('xlink:href');
|
|
|
|
- if (anchor.protocol && !anchor.protocol.match(regex)) {
|
|
|
|
- node.removeAttribute('xlink:href');
|
|
|
|
- }
|
|
|
|
- }
|
|
|
|
-});
|
|
|
|
-
|
|
|
|
-
|
|
|
|
-// Additional safeAttrValue function to allow for other specific protocols
|
|
|
|
-// See https://github.com/leizongmin/js-xss/issues/52#issuecomment-241354114
|
|
|
|
-function mySafeAttrValue(tag, name, value, cssFilter) {
|
|
|
|
- // only when the tag is 'a' and attribute is 'href'
|
|
|
|
- // then use your custom function
|
|
|
|
- if (tag === 'a' && name === 'href') {
|
|
|
|
- // only filter the value if starts with an registered url scheme
|
|
|
|
- urlscheme = value.split(/:/);
|
|
|
|
- //console.log("validating "+urlscheme[0]);
|
|
|
|
- if(urlschemes.includes(urlscheme[0])) return value;
|
|
|
|
- else {
|
|
|
|
- // use the default safeAttrValue function to process all non cbthunderlinks
|
|
|
|
- return sanitizeXss.safeAttrValue(tag, name, value, cssFilter);
|
|
|
|
- }
|
|
|
|
-// } else if (tag === 'svg') {
|
|
|
|
-// return `<img src="data:image/svg+xml;base64,` + atob(value) + `"></img>`;
|
|
|
|
- } else {
|
|
|
|
- // use the default safeAttrValue function to process it
|
|
|
|
- return sanitizeXss.safeAttrValue(tag, name, value, cssFilter);
|
|
|
|
- }
|
|
|
|
-};
|
|
|
|
-*/
|
|
|
|
-
|
|
|
|
var emoji = require('markdown-it-emoji');
|
|
var emoji = require('markdown-it-emoji');
|
|
Markdown.use(emoji);
|
|
Markdown.use(emoji);
|
|
Markdown.use(markdownItMermaid);
|
|
Markdown.use(markdownItMermaid);
|