fix: internal verstak:// links in markdown preview now clickable

Root cause: DOMPurify afterSanitizeAttributes hook was treating verstak:// links as blocked because hash-based href didnt match ALLOWED_SCHEMES regex. Fix: 1. afterSanitizeAttributes hook now checks data-verstak-href first and returns early for internal links - they never get blocked 2. Changed href from hash-based to about:blank (safe value that DOMPurify wont strip, unlike javascript:void(0)) 3. Click handler already uses data-verstak-href, not href Added unit test: markdown.test.js (27 tests for renderer.link output)
2026-06-15 12:15:42 +08:00
parent 077d25a269
commit c8c5531c0c
4 changed files with 147 additions and 22 deletions
@@ -19,7 +19,7 @@
      background: #13131f;
    }
  </style>
-  <script type="module" crossorigin src="/assets/main-FdTYg97q.js"></script>
+  <script type="module" crossorigin src="/assets/main-BpXZraKT.js"></script>
  <link rel="stylesheet" crossorigin href="/assets/main-bQpH1es2.css">
 </head>
 <body>