fix(markdown): resolve media links in the rehype ast

[LinYu369]

Summary / 摘要

fix(markdown): resolve media links in the rehype ast

Media in a markdown file was handled by two string/DOM hacks stacked on
each other: a regex on the raw source rewrote relative urls into
${api}/d/..., and a post-render pass parsed that link back into a
storage path to look up a signed raw url. Both directions were
heuristics, and the second one made every media element fire a request
that was expected to fail.

Move the structural work into a rehype plugin that runs after
rehype-raw and before rehype-sanitize:

• resolve every media url to a storage path once, then build the link
  with getLinkByDirAndObj(), so the share prefix (/sd + pwd), the sign
  and path encoding match the rest of the app; the sign of a sibling is
  already in the folder listing, which costs no extra request
• replace an whose target is a video with a
• handle poster, srcset, and too
• only /fs/get a raw url, per element, when the link actually failed to
  load (a path outside the listing, an encrypted meta); cached with a
  ttl, retried once

This also fixes: rewriting inside fenced code blocks, urls with parens
or a title, attribute injection through a crafted filename, and a
missing max-width for video. While there, the sanitize whitelist uses
hast property names now (playsInline, crossOrigin were no-ops) and
inline base64 pictures survive filtering.

fix(markdown): 用 AST 解析媒体链接，替代字符串与 DOM 两层补丁

原来先用正则把相对路径改写成 /d 链接，渲染后再从 DOM 里反解回存储路径去
换签名链接，两个方向都是启发式，且每个媒体必然先发出一个会失败的请求。

• 新增 rehype 插件（rehype-raw 之后、sanitize 之前）：解析媒体 url，复用
  getLinkByDirAndObj 生成链接，同目录文件的签名直接取列表里的，零额外请求

• 图片语法指向视频时原地替换为

• 同时处理 poster、srcset、、

• 仅当链接确实加载失败才请求 raw_url（带 TTL 缓存，单个元素只重试一次）

• 顺带修：代码块内容被正则污染、url 含括号或 title、文件名构造属性注入、
  video 无宽度约束、白名单属性名写成小写导致 playsinline/crossorigin 失效

• 中文文件夹路径也正常能解析，正常显示图片和链接到具体文件

• User-visible changes / 用户可感知的行为变化:

  • Markdown images now load correctly when sign_all is enabled.
  • Videos in markdown (![](file.mp4) or raw <video> tags) now render and play.
  • Media in shared-page markdown previews also works (backend routes /@s paths to the share API automatically).
  • External image links are untouched.

• Implementation changes / 重要实现变化:

  • After render, fixMediaSrc rewrites relative src of img/video/audio/source to signed raw urls obtained via fs/get (with caching, failure retry and a bounded concurrency pool).
  • ![]() links pointing to video files are rewritten to <video controls> elements.
  • The sanitize schema now allows video/audio/track elements and media attributes (they were previously stripped entirely).
  • Local media links are recognized by origin and the deployment base_path is stripped before resolving the storage path.
  • Removed a leftover console.log debug statement.

• Config / storage / API / compatibility: none.
  / 无配置、存储、API 或兼容性变化。

• This PR has breaking changes.
  / 此 PR 包含破坏性变更。

• This PR changes public API, config, storage format, or migration behavior.
  / 此 PR 修改了公开 API、配置、存储格式或迁移行为。

• This PR requires corresponding changes in related repositories.
  / 此 PR 需要关联仓库同步修改。

Related repository PRs / 关联仓库 PR:

• OpenList: N/A
• OpenList-Docs: N/A

Related Issues / 关联 Issue

N/A（无关联 Issue，本节可删除）

Testing / 测试

• go test ./... — N/A, this is a frontend-only repository.
  / 不适用，本仓库为纯前端仓库，无 Go 代码。
• pnpm lint (tsc --noEmit) — no errors in the changed file; the remaining errors are pre-existing and unrelated to this PR.
  / 变更文件无类型错误；其余报错为与本 PR 无关的既有问题。
• pnpm build — succeeds.
• Manual test / 手动测试:
  • Environment: OpenList-Desktop v4.2.4 (backend) serving this dist, with sign_all = true.
  • Markdown images display correctly; Network tab shows POST /api/fs/get returning a signed raw_url, and image requests hit /p/...?sign=... with 200.
  • ![](xxx.mp4) renders as a playable <video> with controls.
  • Raw <video src="..." controls> tags play as well.
  • External (http(s) other-origin) images are unaffected.
  • Share-page previews: covered by the same code path (backend routes /@s to the share API), not manually verified — please double-check with a share link if possible.
    / 分享页预览未手动验证（代码路径与普通预览一致），建议维护者用分享链接补充验证。

修复前

修复后的效果

测试用的md代码，媒体和md是在同一个目录下

## 2026-08 测试md
2026-08-16 05:04 
测试111

<video src="测试视频1.mp4" controls></video>
979 Likes, 92 Retweets, 1 Replies


2022-04-02 04:34 [src]

测试222
[![](2022-05-03-08-20-img_16.jpg)]
411 Likes, 20 Retweets, 7 Replies

测试
[![](2022-05-03-08-20-img_17.jpg)]
411 Likes, 20 Retweets, 7 Replies

Checklist / 检查清单

• I have read CONTRIBUTING.
  / 我已阅读 CONTRIBUTING。
• I confirm this contribution follows the repository license, contribution policy, and code of conduct.
  / 我确认此贡献符合仓库许可证、贡献规范和行为准则。
• I have formatted the changed code with gofmt, go fmt, or prettier where applicable.
  / 变更代码遵循项目 prettier 风格（与现有文件一致；本地未运行 prettier 命令）。
• I have requested review from relevant maintainers or code owners where applicable.
  / 不适用（未请求维护者审查）。

AI Disclosure / AI 使用声明

This PR includes AI-assisted content (code generation) produced with Qoder (Lingma). The core fix was manually verified end-to-end (images and videos render correctly with sign_all enabled).

此 PR 包含使用 Qoder (Lingma) 生成的 AI 辅助内容（代码生成），核心修复已端到端手动验证（sign_all 开启时图片、视频均可正常预览）。

• This PR includes AI-assisted content.
  / 此 PR 包含 AI 辅助内容。

Tools used / 使用工具:

• ChatGPT
• Codex
• GitHub Copilot
• Claude
• Gemini
• Other (please specify) / 其他（请注明）: Qoder (Lingma)

Usage scope / 使用范围:

• Code generation / 代码生成

• Refactoring / 重构

• Documentation / 文档

• Tests / 测试

• Translation / 翻译

• Review assistance / 审查辅助

• I have reviewed and validated all AI-assisted content included in this PR.
  / 我已审核并验证此 PR 中的所有 AI 辅助内容。

• I have ensured that all AI-assisted commits include Co-Authored-By attribution.
  / 我已确保所有 AI 辅助提交都包含 Co-Authored-By 归属信息。（当前 commit 未包含，见下方说明）

• I can reproduce all AI-assisted content included in this PR without any AI tools.
  / 我可以在没有任何 AI 工具的情况下重现此 PR 中包含的所有 AI 辅助内容。（无法勾选，如实声明）