Root cause: DOMPurify afterSanitizeAttributes hook was treating verstak:// links as blocked because hash-based href didnt match ALLOWED_SCHEMES regex. Fix: 1. afterSanitizeAttributes hook now checks data-verstak-href first and returns early for internal links - they never get blocked 2. Changed href from hash-based to about:blank (safe value that DOMPurify wont strip, unlike javascript:void(0)) 3. Click handler already uses data-verstak-href, not href Added unit test: markdown.test.js (27 tests for renderer.link output) |
||
|---|---|---|
| .. | ||
| app-icons | ||
| main-BpXZraKT.js | ||
| main-bQpH1es2.css | ||