Dmitry Verkhoturov
243c8356e7
Previously it was sanitised using the HTML sanitiser, but it had proven troublesome and unnecessary. Remark42 rendered the markdown into proper HTML, but then some pieces of it (like cited HTML code inside the code block, marked by backticks) were cut out, which then showed the incorrect markdown to a user when they were editing the comment. For example, the comment "`foo<bar>`" became "foo" after sanitising, and despite the proper render user saw only "foo" when editing the comment. After this change, the initial comment markdown is preserved unaltered. It could contain dangerous HTML with JS, which I assume shouldn't be a problem as it's never rendered as HTML but instead supposed to be converted to HTML by the interpreter. In Remark42, it's stored in a comment.Text field and sanitised and thus safe. I've left information about the potential danger of rendering the original markdown as-is without an interpreter in all relevant places I could find.
Remark42 site
Work on your local environment
Requirements:
- Node.js v14 or higher - install from package or with Homebrew
- Yarn 1.22 or higher - once you have Node.js, run
npm i -g yarn
Development
Install dependencies and start the development server:
yarn
yarn dev
Build
yarn build
Work with Docker Compose
Build
Install dependencies and run development server inside Docker:
docker-compose build
docker-compose up server
Then serve files from ./build with your favorite server
Development
docker-compose up --build server
Then head to http://localhost:8080