Fixed build,

added Dompurify, Marked working
ordinals · Sep 5, 2023 · bf353b8 · bf353b8
1 parent a161008
commit bf353b8
Show file tree

Hide file tree

Showing 5 changed files with 16 additions and 10 deletions.
diff --git a/src/subcommand/server.rs b/src/subcommand/server.rs
@@ -966,9 +966,9 @@ impl Server {
       Media::Markdown => Ok(
         (
           [(
-            header::CONTENT_SECURITY_POLICY,
-            "default-src 'self' https://cdn.jsdelivr.net",
-          )],
+              header::CONTENT_SECURITY_POLICY,
+              "script-src-elem 'self' https://cdn.jsdelivr.net",
+            )],
           PreviewMarkdownHtml { inscription_id },
         )
           .into_response(),

diff --git a/src/templates.rs b/src/templates.rs
@@ -12,7 +12,7 @@ pub(crate) use {
   output::{OutputHtml, OutputJson},
   page_config::PageConfig,
   preview::{
-    PreviewAudioHtml, PreviewImageHtml, PreviewModelHtml, PreviewPdfHtml, PreviewTextHtml,
+    PreviewAudioHtml, PreviewImageHtml, PreviewModelHtml, PreviewPdfHtml, PreviewMarkdownHtml, PreviewTextHtml,
     PreviewUnknownHtml, PreviewVideoHtml,
   },
   range::RangeHtml,

diff --git a/static/preview-markdown.css b/static/preview-markdown.css
@@ -0,0 +1,4 @@
+ html {
+  color: #98a3ad;
+  background-color: #131516;
+}
diff --git a/static/preview-markdown.js b/static/preview-markdown.js
@@ -1,15 +1,16 @@
-import marked from 'https://cdn.jsdelivr.net/npm/marked/marked.min.js';
+import { marked } from 'https://cdn.jsdelivr.net/npm/marked@8.0.0/+esm'
+import DOMPurify from 'https://cdn.jsdelivr.net/npm/dompurify@3.0.5/+esm'
 
 async function renderMarkdown() {
   const contentDiv = document.getElementById('content');
 
   const inscriptionId = contentDiv.dataset.inscription;
   const response = await fetch(`/content/${inscriptionId}`);
-  const markdownContent = await response.text();
+  const rawMarkdown = await response.text();
 
-  const htmlContent = marked.parse(markdownContent);
-  
-  contentDiv.innerHTML = htmlContent;
+  const html = DOMPurify.sanitize(marked.parse(rawMarkdown));
+
+  contentDiv.innerHTML = html;
 }
 
 window.addEventListener('DOMContentLoaded', renderMarkdown);
diff --git a/templates/preview-markdown.html b/templates/preview-markdown.html
@@ -2,9 +2,10 @@
 <html lang="en">
   <head>
     <meta charset="utf-8">
-    <script src="/static/preview-markdown.js" defer type="module"></script>
+    <link rel=stylesheet href="/static/preview-markdown.css"></link>
   </head>
   <body>
     <div id="content" data-inscription="{{self.inscription_id}}"></div>
+    <script src="/static/preview-markdown.js" defer type="module"></script>
   </body>
 </html>