multica

mirror of https://github.com/multica-ai/multica.git synced 2026-07-05 13:29:44 +02:00

Files

Naiyuan Qing ba003eee83 fix(server/comment): remove HTML sanitizer that was corrupting Markdown (#1387 ) (#1436 )

The bluemonday HTML sanitizer applied to comment content (added in #679)
treats Markdown source as HTML, entity-encoding syntactically meaningful
characters and normalizing whitespace. This corrupts user input:

  - "> quote"   -> "&gt; quote"     (blockquote lost, see #1303)
  - '"foo"'     -> '&#34;foo&#34;'    (literal entities visible)
  - "\n\n2." -> " 2."             (ordered list items merged into prose)

Comment content is stored as Markdown source. XSS is already handled at
two layers:

  - Render: rehype-sanitize in packages/ui/markdown and
    packages/views/editor/readonly-content (mention:// allowlist,
    data-href restricted to http(s), class restricted to
    code/div/span/pre).
  - Edit: @tiptap/markdown is configured with html:false, so Markdown
    source containing raw HTML tags is treated as plain text.

Removing the server-side sanitizer therefore does not lower the security
boundary, and restores faithful Markdown round-tripping.

The PR #1342 workaround in the editor serializer can be dropped once
this lands.

Co-authored-by: devv-eve <eve@devv.ai>
Co-authored-by: Eve <eve@multica.ai>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-04-21 15:40:30 +08:00

cmd

feat(analytics): full PostHog pipeline + 6 funnel events (MUL-1122) (#1367 )

2026-04-21 14:42:52 +08:00

internal

fix(server/comment): remove HTML sanitizer that was corrupting Markdown (#1387 ) (#1436 )

2026-04-21 15:40:30 +08:00

migrations

feat(analytics): full PostHog pipeline + 6 funnel events (MUL-1122) (#1367 )

2026-04-21 14:42:52 +08:00

pkg

feat(analytics): full PostHog pipeline + 6 funnel events (MUL-1122) (#1367 )