3 Commits

Author	SHA1	Message	Date
Jiayuan Zhang	6c5879215d	fix: sanitize markdown rendering in comments and shared renderers (#679) ... * fix: sanitize markdown rendering in comments and shared renderers Add rehype-sanitize to both ReadonlyContent and Markdown components so that raw HTML parsed by rehype-raw is sanitized against a strict allowlist before reaching the DOM. On the backend, add a bluemonday sanitization pass when creating and updating comments to strip dangerous tags as defense-in-depth. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add mention:// protocol to sanitize allowlist and validate file card URLs - Add mention:// to rehype-sanitize protocols.href in both ReadonlyContent and Markdown so @mention links survive sanitization - Validate data-href on file cards to only allow http(s) URLs, blocking javascript: and data: schemes in both frontend click handler and backend bluemonday policy - Narrow class attribute allowlist to specific elements (code, div, span, pre) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-11 03:44:30 +08:00
Naiyuan Qing	ba32f3a187	chore: add shared ESLint config + enforce strict tsconfig across packages ... - Add @multica/eslint-config package (base, react, next configs) - Replace `next lint` (removed in Next.js 16) with `eslint .` - Add lint scripts to all packages and desktop app - Add noUnusedLocals, noUnusedParameters, noImplicitReturns to base tsconfig - Fix all resulting TS/ESLint errors (unused imports, missing returns, stale eslint-disable comments from legacy eslint-config-next) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-10 08:27:29 +08:00
Naiyuan Qing	35828492d5	feat(ui): extract packages/ui — shared atomic UI layer ... - Move 55 shadcn components → packages/ui/components/ui/ - Move lib/utils.ts (cn function) → packages/ui/lib/ - Move 3 DOM hooks (auto-scroll, mobile, scroll-fade) → packages/ui/hooks/ - Extract CSS design tokens (@theme + :root + .dark) → packages/ui/styles/tokens.css - Refactor 3 common components to pure-props (actor-avatar, mention-hover-card, reaction-bar) - Move 6 markdown components with renderMention slot for IssueMentionCard decoupling - Create wrapper components in apps/web/ for data-aware ActorAvatar and Markdown - Update 116 import paths across apps/web/ - Add @source directives for Tailwind to scan packages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-09 10:44:31 +08:00