From af1581b4c5bd9c906a471a1b544de78e807854be Mon Sep 17 00:00:00 2001 From: Kory Prince Date: Mon, 26 Mar 2018 23:13:54 -0500 Subject: [PATCH] Migrate to Marked.js + js-xss for Markdown parsing (#1026) * Migrate to Marked.js + js-xss for Markdown parsing * Update JS Updating JS with latest source code from NPM to ensure it has not been altered --- public/markdown-js.html | 14 ++++++ public/pagedown-js.html | 84 --------------------------------- src/components/ha-markdown.html | 9 ++-- 3 files changed, 20 insertions(+), 87 deletions(-) create mode 100644 public/markdown-js.html delete mode 100644 public/pagedown-js.html diff --git a/public/markdown-js.html b/public/markdown-js.html new file mode 100644 index 0000000000..a44d7f7061 --- /dev/null +++ b/public/markdown-js.html @@ -0,0 +1,14 @@ + diff --git a/public/pagedown-js.html b/public/pagedown-js.html deleted file mode 100644 index 53bbd4e2b5..0000000000 --- a/public/pagedown-js.html +++ /dev/null @@ -1,84 +0,0 @@ - diff --git a/src/components/ha-markdown.html b/src/components/ha-markdown.html index cf40a2acb7..5af8274849 100644 --- a/src/components/ha-markdown.html +++ b/src/components/ha-markdown.html @@ -11,7 +11,7 @@ class HaMarkdown extends window.hassMixins.EventsMixin(HTMLElement) { this._resize = () => this.fire('iron-resize'); Polymer.importHref( - '/static/pagedown-js.html', + '/static/markdown-js.html', () => { this._scriptLoaded = 1; this._render(); }, () => { this._scriptLoaded = 2; this._render(); }, ); @@ -32,8 +32,11 @@ class HaMarkdown extends window.hassMixins.EventsMixin(HTMLElement) { this._renderScheduled = false; if (this._scriptLoaded === 1) { - const converter = window.Markdown.getSanitizingConverter(); - this.innerHTML = converter.makeHtml(this._content); + this.innerHTML = window.filterXSS(window.marked(this._content, { + gfm: true, + tables: true, + breaks: true + })); this._resize(); const walker = document.createTreeWalker(this, 1 /* SHOW_ELEMENT */, null, false);