fix: internal verstak:// links in markdown preview now clickable

Browse Source

Root cause: DOMPurify afterSanitizeAttributes hook was treating verstak://
links as blocked because hash-based href didnt match ALLOWED_SCHEMES regex.

Fix:
1. afterSanitizeAttributes hook now checks data-verstak-href first and
   returns early for internal links - they never get blocked
2. Changed href from hash-based to about:blank (safe value that
   DOMPurify wont strip, unlike javascript:void(0))
3. Click handler already uses data-verstak-href, not href

Added unit test: markdown.test.js (27 tests for renderer.link output)

...

This commit is contained in:

mirivlad

2026-06-15 12:15:42 +08:00

parent 077d25a269

commit c8c5531c0c

4 changed files with 147 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

cmd/verstak-gui/frontend-dist/assets/main-FdTYg97q.js → cmd/verstak-gui/frontend-dist/assets/main-BpXZraKT.js

+17 -17

File diff suppressed because one or more lines are too long