From 875e2d426dd8cb3229ffa031070868c4e73e5b0d Mon Sep 17 00:00:00 2001 From: Max Burri Date: Tue, 7 Jul 2026 11:56:56 +0000 Subject: [PATCH 01/12] chore: add dev-container configuration --- .devcontainer/Dockerfile | 12 +++++++ .devcontainer/devcontainer-lock.json | 17 ++++++++++ .devcontainer/devcontainer.json | 27 +++++++++++++++ .devcontainer/docker-compose.yml | 50 ++++++++++++++++++++++++++++ 4 files changed, 106 insertions(+) create mode 100644 .devcontainer/Dockerfile create mode 100644 .devcontainer/devcontainer-lock.json create mode 100644 .devcontainer/devcontainer.json create mode 100644 .devcontainer/docker-compose.yml diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile new file mode 100644 index 000000000..cdf72aded --- /dev/null +++ b/.devcontainer/Dockerfile @@ -0,0 +1,12 @@ +FROM mcr.microsoft.com/devcontainers/javascript-node:4-24-trixie + +# [Optional] Uncomment this section to install additional OS packages. +# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \ +# && apt-get -y install --no-install-recommends + +# [Optional] Uncomment if you want to install an additional version of node using nvm +# ARG EXTRA_NODE_VERSION=10 +# RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install ${EXTRA_NODE_VERSION}" + +# [Optional] Uncomment if you want to install more global node modules +# RUN su node -c "npm install -g " diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json new file mode 100644 index 000000000..396a83672 --- /dev/null +++ b/.devcontainer/devcontainer-lock.json @@ -0,0 +1,17 @@ +{ + "features": { + "ghcr.io/devcontainers-community/npm-features/prettier:1": { + "version": "1.1.0", + "resolved": "ghcr.io/devcontainers-community/npm-features/prettier@sha256:41aca434d43373d78b276d3cd89ecdce960e0b618ff0ee59f2ecee0810dbabe9", + "integrity": "sha256:41aca434d43373d78b276d3cd89ecdce960e0b618ff0ee59f2ecee0810dbabe9", + "dependsOn": [ + "ghcr.io/devcontainers/features/node" + ] + }, + "ghcr.io/devcontainers/features/node": { + "version": "2.1.0", + "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857", + "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857" + } + } +} diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json new file mode 100644 index 000000000..9c9d4d26d --- /dev/null +++ b/.devcontainer/devcontainer.json @@ -0,0 +1,27 @@ +// For format details, see https://aka.ms/devcontainer.json. For config options, see the +// README at: https://github.com/devcontainers/templates/tree/main/src/javascript-node-postgres +{ + "name": "Node.js & PostgreSQL", + "dockerComposeFile": "docker-compose.yml", + "service": "app", + "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}", + "features": { + "ghcr.io/devcontainers-community/npm-features/prettier:1": {} + } + + // Features to add to the dev container. More info: https://containers.dev/features. + // "features": {}, + + // Use 'forwardPorts' to make a list of ports inside the container available locally. + // This can be used to network with other containers or with the host. + // "forwardPorts": [3000, 5432], + + // Use 'postCreateCommand' to run commands after the container is created. + // "postCreateCommand": "yarn install", + + // Configure tool-specific properties. + // "customizations": {}, + + // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. + // "remoteUser": "root" +} diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml new file mode 100644 index 000000000..5330afed4 --- /dev/null +++ b/.devcontainer/docker-compose.yml @@ -0,0 +1,50 @@ +volumes: + postgres-data: + +services: + app: + build: + context: . + dockerfile: Dockerfile + + volumes: + - ../..:/workspaces:cached + + # Overrides default command so things don't shut down after the process ends. + command: sleep infinity + + # Use proper Docker networking instead of network_mode: service:db + # to ensure reliable DNS resolution in all environments + depends_on: + db: + condition: service_healthy + networks: + - app-network + + # Use "forwardPorts" in **devcontainer.json** to forward an app port locally. + # (Adding the "ports" property to this file will not forward from a Codespace.) + + db: + image: postgres:latest + restart: unless-stopped + networks: + - app-network + healthcheck: + test: ["CMD-SHELL", "pg_isready -U postgres"] + interval: 10s + timeout: 5s + retries: 5 + start_period: 30s + volumes: + - postgres-data:/var/lib/postgresql + environment: + POSTGRES_PASSWORD: postgres + POSTGRES_USER: postgres + POSTGRES_DB: postgres + + # Add "forwardPorts": ["5432"] to **devcontainer.json** to forward PostgreSQL locally. + # (Adding the "ports" property to this file will not forward from a Codespace.) + +networks: + app-network: + driver: bridge From bd47245301d8dd0af37e829b5fdde217ed446ca5 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Tue, 7 Jul 2026 14:14:32 +0000 Subject: [PATCH 02/12] chore: add yarn cache config --- .devcontainer/devcontainer-lock.json | 2 +- .devcontainer/docker-compose.yml | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json index 396a83672..362bdf3db 100644 --- a/.devcontainer/devcontainer-lock.json +++ b/.devcontainer/devcontainer-lock.json @@ -14,4 +14,4 @@ "integrity": "sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857" } } -} +} \ No newline at end of file diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml index 5330afed4..d19d6a839 100644 --- a/.devcontainer/docker-compose.yml +++ b/.devcontainer/docker-compose.yml @@ -1,5 +1,6 @@ volumes: postgres-data: + yarn-cache: services: app: @@ -9,6 +10,10 @@ services: volumes: - ../..:/workspaces:cached + - yarn-cache:/home/node/.cache/yarn + + environment: + YARN_CACHE_FOLDER: /home/node/.cache/yarn # Overrides default command so things don't shut down after the process ends. command: sleep infinity From 03b6f9d504874bceed68540163eb9f595d6c5923 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Tue, 7 Jul 2026 14:21:06 +0000 Subject: [PATCH 03/12] chore: mount git config into dev container --- .devcontainer/devcontainer.json | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 9c9d4d26d..171ccda2f 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -7,7 +7,11 @@ "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}", "features": { "ghcr.io/devcontainers-community/npm-features/prettier:1": {} - } + }, + "mounts": [ + "source=${localEnv:HOME}/.gitconfig,target=/root/.gitconfig,type=bind,consistency=cached" + ] + // Features to add to the dev container. More info: https://containers.dev/features. // "features": {}, From 2264906c626b518b46c177b936cb17c119233292 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Tue, 7 Jul 2026 14:34:21 +0000 Subject: [PATCH 04/12] chore: use correct setup for the yarn cache with the microsoft node image --- .devcontainer/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml index d19d6a839..d57df4544 100644 --- a/.devcontainer/docker-compose.yml +++ b/.devcontainer/docker-compose.yml @@ -10,7 +10,7 @@ services: volumes: - ../..:/workspaces:cached - - yarn-cache:/home/node/.cache/yarn + - yarn-cache:/home/node/.yarn-cache environment: YARN_CACHE_FOLDER: /home/node/.cache/yarn From 02f16b9ac252f502cd0e461cca41149b966ca7c7 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Tue, 7 Jul 2026 17:48:47 +0200 Subject: [PATCH 05/12] chore: add docker to devcontainer --- .devcontainer/devcontainer-lock.json | 5 +++++ .devcontainer/devcontainer.json | 7 +++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json index 362bdf3db..3d40882e9 100644 --- a/.devcontainer/devcontainer-lock.json +++ b/.devcontainer/devcontainer-lock.json @@ -8,6 +8,11 @@ "ghcr.io/devcontainers/features/node" ] }, + "ghcr.io/devcontainers/features/docker-outside-of-docker:1": { + "version": "1.10.0", + "resolved": "ghcr.io/devcontainers/features/docker-outside-of-docker@sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e", + "integrity": "sha256:c2c2cf829505ead8e4892c88c31b6594ae94a2bbb209e16e1fac456c1a3a624e" + }, "ghcr.io/devcontainers/features/node": { "version": "2.1.0", "resolved": "ghcr.io/devcontainers/features/node@sha256:586c9a6f7dd40bd3ba2cd41e7f2f88dcc31fbe5d1442afcbf07ffbc66b686857", diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 171ccda2f..ca38c94af 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -6,11 +6,14 @@ "service": "app", "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}", "features": { - "ghcr.io/devcontainers-community/npm-features/prettier:1": {} + "ghcr.io/devcontainers-community/npm-features/prettier:1": {}, + "ghcr.io/devcontainers/features/docker-outside-of-docker:1": { + "moby": false + } }, "mounts": [ "source=${localEnv:HOME}/.gitconfig,target=/root/.gitconfig,type=bind,consistency=cached" - ] + ] // Features to add to the dev container. More info: https://containers.dev/features. From 9cff2755e75a26f102a0633e0e676c650e4fc7c3 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Wed, 8 Jul 2026 06:57:02 +0000 Subject: [PATCH 06/12] chore: correct git config for codium --- .devcontainer/devcontainer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index ca38c94af..6bc8fa813 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -12,7 +12,7 @@ } }, "mounts": [ - "source=${localEnv:HOME}/.gitconfig,target=/root/.gitconfig,type=bind,consistency=cached" + "source=${localEnv:HOME}/.gitconfig,target=/home/node/.gitconfig,type=bind,consistency=cached" ] From eb0141ca3f5a32a83fcd86e5fbf34d77ead26870 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Wed, 8 Jul 2026 07:54:36 +0000 Subject: [PATCH 07/12] chore: make the app run with and without devcontainers --- .devcontainer/devcontainer.json | 6 +++++- .devcontainer/docker-compose.yml | 6 +++--- package.json | 2 +- readme/dev.md | 9 +++++++++ 4 files changed, 18 insertions(+), 5 deletions(-) diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index 6bc8fa813..c299c4174 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -13,7 +13,11 @@ }, "mounts": [ "source=${localEnv:HOME}/.gitconfig,target=/home/node/.gitconfig,type=bind,consistency=cached" - ] + ], + + "containerEnv": { + "DATABASE_URL": "postgres://postgres:password@db:5432/visualization_tool" + } // Features to add to the dev container. More info: https://containers.dev/features. diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml index d57df4544..ca7f587de 100644 --- a/.devcontainer/docker-compose.yml +++ b/.devcontainer/docker-compose.yml @@ -30,7 +30,7 @@ services: # (Adding the "ports" property to this file will not forward from a Codespace.) db: - image: postgres:latest + image: postgres:18-alpine restart: unless-stopped networks: - app-network @@ -43,9 +43,9 @@ services: volumes: - postgres-data:/var/lib/postgresql environment: - POSTGRES_PASSWORD: postgres + POSTGRES_PASSWORD: password POSTGRES_USER: postgres - POSTGRES_DB: postgres + POSTGRES_DB: visualization_tool # Add "forwardPorts": ["5432"] to **devcontainer.json** to forward PostgreSQL locally. # (Adding the "ports" property to this file will not forward from a Codespace.) diff --git a/package.json b/package.json index a8633a338..e5fb0ce82 100644 --- a/package.json +++ b/package.json @@ -16,7 +16,7 @@ "dev:ssl": "preconstruct dev && NODE_OPTIONS=\"--inspect --openssl-legacy-provider \" next dev --experimental-https ./app", "dev:mitmproxy": "preconstruct dev && HTTP_PROXY=http://localhost:8080 NODE_EXTRA_CA_CERTS=~/.mitmproxy/mitmproxy-ca-cert.pem GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE='' NO_PROXY='localhost,127.0.0.1' next ./app", "dev:rollup": "rollup -c rollup.config.js --watch", - "db:migrate:dev": "DATABASE_URL=postgres://postgres:password@localhost:5432/visualization_tool prisma db push", + "db:migrate:dev": "DATABASE_URL=${DATABASE_URL:-postgres://postgres:password@localhost:5432/visualization_tool} prisma db push", "db:migrate": "[ -z \"$DATABASE_URL\" ] && echo 'Bypassing database migration, DATABASE_URL not set' || prisma db push", "build": "yarn graphql:codegen && lingui compile && rollup -c rollup.config.js && yarn storybook:build && yarn generate-json-schema && next build ./app", "build:npm": "yarn graphql:codegen && lingui compile && BABEL_ENV=NPM_PACKAGE preconstruct build", diff --git a/readme/dev.md b/readme/dev.md index 0c0228d2d..1e4e14698 100644 --- a/readme/dev.md +++ b/readme/dev.md @@ -114,3 +114,12 @@ yarn db:migrate:dev > scoping the new environment variables to the preview branch you are working > on. After merging the branch, you can delete the environment variables scoped > to the branch. + + +# Using dev-containers + +Rebuild the devcontainer: +```bash +npm install -g @devcontainers/cli +devcontainer up --workspace-folder /workspaces/visualization-tool --remove-existing-container --build-no-cache +``` From 34869547bc397b08b2d702f86c547e4ff745312f Mon Sep 17 00:00:00 2001 From: Max Burri Date: Wed, 8 Jul 2026 08:20:04 +0000 Subject: [PATCH 08/12] chore: add some extensions, install devcontainer cli, add documentation and changelog --- .devcontainer/Dockerfile | 2 +- .devcontainer/devcontainer.json | 62 +++++++++++++++++++-------------- CHANGELOG.md | 3 ++ readme/dev.md | 14 ++++++-- 4 files changed, 50 insertions(+), 31 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index cdf72aded..fefeede03 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -9,4 +9,4 @@ FROM mcr.microsoft.com/devcontainers/javascript-node:4-24-trixie # RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install ${EXTRA_NODE_VERSION}" # [Optional] Uncomment if you want to install more global node modules -# RUN su node -c "npm install -g " +RUN su node -c "npm install -g @devcontainers/cli" diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index c299c4174..1b3f444ce 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -1,38 +1,46 @@ // For format details, see https://aka.ms/devcontainer.json. For config options, see the // README at: https://github.com/devcontainers/templates/tree/main/src/javascript-node-postgres { - "name": "Node.js & PostgreSQL", - "dockerComposeFile": "docker-compose.yml", - "service": "app", - "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}", - "features": { - "ghcr.io/devcontainers-community/npm-features/prettier:1": {}, - "ghcr.io/devcontainers/features/docker-outside-of-docker:1": { - "moby": false - } - }, - "mounts": [ - "source=${localEnv:HOME}/.gitconfig,target=/home/node/.gitconfig,type=bind,consistency=cached" - ], - - "containerEnv": { - "DATABASE_URL": "postgres://postgres:password@db:5432/visualization_tool" + "name": "Node.js & PostgreSQL", + "dockerComposeFile": "docker-compose.yml", + "service": "app", + "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}", + "features": { + "ghcr.io/devcontainers-community/npm-features/prettier:1": {}, + "ghcr.io/devcontainers/features/docker-outside-of-docker:1": { + "moby": false } + }, + "mounts": [ + "source=${localEnv:HOME}/.gitconfig,target=/home/node/.gitconfig,type=bind,consistency=cached" + ], + "containerEnv": { + "DATABASE_URL": "postgres://postgres:password@db:5432/visualization_tool" + }, - // Features to add to the dev container. More info: https://containers.dev/features. - // "features": {}, + // Features to add to the dev container. More info: https://containers.dev/features. + // "features": {}, - // Use 'forwardPorts' to make a list of ports inside the container available locally. - // This can be used to network with other containers or with the host. - // "forwardPorts": [3000, 5432], + // Use 'forwardPorts' to make a list of ports inside the container available locally. + // This can be used to network with other containers or with the host. + // "forwardPorts": [3000, 5432], - // Use 'postCreateCommand' to run commands after the container is created. - // "postCreateCommand": "yarn install", + // Use 'postCreateCommand' to run commands after the container is created. + "postCreateCommand": "yarn install", - // Configure tool-specific properties. - // "customizations": {}, + // Configure tool-specific properties. + "customizations": { + "vscode": { + "extensions": [ + "dbaeumer.vscode-eslint", + "esbenp.prettier-vscode", + "ms-azuretools.vscode-docker", + "codeandstuff.package-json-upgrade" + ] + } + } - // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. - // "remoteUser": "root" + // Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root. + // "remoteUser": "root" } diff --git a/CHANGELOG.md b/CHANGELOG.md index ad618f37c..c559a9a14 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,9 @@ You can also check the ## Unreleased +- Maintenance + - Add dev-container support + ## 6.5.0 – 2026-06-01 - Features diff --git a/readme/dev.md b/readme/dev.md index 1e4e14698..04aed7425 100644 --- a/readme/dev.md +++ b/readme/dev.md @@ -115,11 +115,19 @@ yarn db:migrate:dev > on. After merging the branch, you can delete the environment variables scoped > to the branch. +# Dev-containers -# Using dev-containers +You can use dev-containers for development if you want to have a consistent +environment. + +Codeium based IDE do not support some convenience functionality like "Rebuild +container" after changes to the devcontainer configuration. The devcontainer-cli +is shipped with the devcontainer image and can be used to rebuild the +devcontainer: -Rebuild the devcontainer: ```bash -npm install -g @devcontainers/cli devcontainer up --workspace-folder /workspaces/visualization-tool --remove-existing-container --build-no-cache ``` + +⚠️ Supporting/ Using dev-containers is currently under development and not fully +tested, please report if you run into issues. From 5ec26d986cdf4360170fdc468738bbb35b0b49f8 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Wed, 8 Jul 2026 13:47:21 +0000 Subject: [PATCH 09/12] chore: harden markdown renderer sanitization --- app/components/markdown.tsx | 43 +++++++++++++++++++++++++++++++++---- 1 file changed, 39 insertions(+), 4 deletions(-) diff --git a/app/components/markdown.tsx b/app/components/markdown.tsx index c99a39682..f69e4a954 100644 --- a/app/components/markdown.tsx +++ b/app/components/markdown.tsx @@ -1,13 +1,46 @@ import clsx from "clsx"; import { ComponentProps } from "react"; import ReactMarkdown from "react-markdown"; -import rehypeRaw from "rehype-raw"; -import rehypeSanitize from "rehype-sanitize"; +import rehypeSanitize, { defaultSchema } from "rehype-sanitize"; import remarkGfm from "remark-gfm"; import classes from "@/components/markdown.module.css"; import { palette } from "@/themes/palette"; +const sanitizeSchema = { + ...defaultSchema, + tagNames: [ + "h1", + "h2", + "h3", + "h4", + "h5", + "h6", + "p", + "strong", + "em", + "ins", + "del", + "s", + "ul", + "ol", + "li", + "blockquote", + "code", + "pre", + "br", + "hr", + "a", + ], + attributes: { + ...defaultSchema.attributes, + a: ["href", "title", "target"], + "*": (defaultSchema.attributes?.["*"] ?? []).filter( + (attr) => !(typeof attr === "string" && attr.startsWith("on")) + ), + }, +}; + const components: ComponentProps["components"] = { h1: ({ children, className, ...props }) => (

@@ -47,6 +80,7 @@ const components: ComponentProps["components"] = { a: ({ children, className, style, ...props }) => ( ); @@ -165,6 +199,7 @@ const componentsInheritFonts: ComponentProps< @@ -180,7 +215,7 @@ export const MarkdownInheritFonts = ( ); From a95dee39ab12aa886ea678ff814879a12ec9fb90 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Wed, 8 Jul 2026 14:05:31 +0000 Subject: [PATCH 10/12] doc: add changelog entry --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c559a9a14..38a09b19b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,8 @@ You can also check the ## Unreleased +- Fixes + - Harden markdown renderer sanitization - Maintenance - Add dev-container support From baab8153c4b1d1f27f94c288421ca0f184a316af Mon Sep 17 00:00:00 2001 From: Max Burri Date: Wed, 8 Jul 2026 14:11:32 +0000 Subject: [PATCH 11/12] chore: remove unused dependency --- app/package.json | 1 - 1 file changed, 1 deletion(-) diff --git a/app/package.json b/app/package.json index 2aa8f0394..cf046c6d1 100644 --- a/app/package.json +++ b/app/package.json @@ -153,7 +153,6 @@ "react-transition-group": "^4.4.5", "react-virtualized-auto-sizer": "^1.0.25", "react-window": "^1.8.10", - "rehype-raw": "^7.0.0", "rehype-sanitize": "^6.0.0", "remark-gfm": "^4.0.0", "simple-statistics": "^7.6.0", From 45193d13c8416d4ffe78f603e2b5cb01df7b4cc3 Mon Sep 17 00:00:00 2001 From: Max Burri Date: Wed, 8 Jul 2026 14:22:54 +0000 Subject: [PATCH 12/12] chore: fixes after review --- app/components/markdown.tsx | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/app/components/markdown.tsx b/app/components/markdown.tsx index f69e4a954..7dca5c1fe 100644 --- a/app/components/markdown.tsx +++ b/app/components/markdown.tsx @@ -34,10 +34,8 @@ const sanitizeSchema = { ], attributes: { ...defaultSchema.attributes, - a: ["href", "title", "target"], - "*": (defaultSchema.attributes?.["*"] ?? []).filter( - (attr) => !(typeof attr === "string" && attr.startsWith("on")) - ), + a: ["href", "title"], + "*": defaultSchema.attributes?.["*"] ?? [], }, }; @@ -79,11 +77,11 @@ const components: ComponentProps["components"] = { ), a: ({ children, className, style, ...props }) => ( {children} @@ -115,7 +113,11 @@ export const InlineMarkdown = ({ p: ({ children }) => <>{children}, strong: ({ children }) => {children}, em: ({ children }) => {children}, - a: ({ children, href }) => {children}, + a: ({ children, href }) => { + const safeHref = + href && /^(https?|mailto|ircs?):/i.test(href) ? href : undefined; + return {children}; + }, h1: () => null, h2: () => null, h3: () => null, @@ -197,11 +199,11 @@ const componentsInheritFonts: ComponentProps< ), a: ({ children, className, style, ...props }) => ( {children}