multica

mirror of https://github.com/multica-ai/multica.git synced 2026-07-05 13:29:44 +02:00

Files

devv-eve 4a25b91590 fix(server/comment): remove HTML sanitizer that was corrupting Markdown (#1387 )

The bluemonday HTML sanitizer applied to comment content (added in #679)
treats Markdown source as HTML, entity-encoding syntactically meaningful
characters and normalizing whitespace. This corrupts user input:

  - "> quote"   -> "&gt; quote"     (blockquote lost, see #1303)
  - '"foo"'     -> '&#34;foo&#34;'    (literal entities visible)
  - "\n\n2." -> " 2."             (ordered list items merged into prose)

Comment content is stored as Markdown source. XSS is already handled at
two layers:

  - Render: rehype-sanitize in packages/ui/markdown and
    packages/views/editor/readonly-content (mention:// allowlist,
    data-href restricted to http(s), class restricted to
    code/div/span/pre).
  - Edit: @tiptap/markdown is configured with html:false, so Markdown
    source containing raw HTML tags is treated as plain text.

Removing the server-side sanitizer therefore does not lower the security
boundary, and restores faithful Markdown round-tripping.

The PR #1342 workaround in the editor serializer can be dropped once
this lands.

Co-authored-by: Eve <eve@multica.ai>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-04-21 09:37:43 +08:00

cmd

feat(agents): add per-agent model field with provider-aware dropdown (#1399 )

2026-04-21 00:06:34 +08:00

internal

fix(server/comment): remove HTML sanitizer that was corrupting Markdown (#1387 )

2026-04-21 09:37:43 +08:00

migrations

feat(agents): add per-agent model field with provider-aware dropdown (#1399 )

2026-04-21 00:06:34 +08:00

pkg

feat(agent): add Kimi CLI as agent runtime (#1400 )