mirivlad
c8c5531c0c
Root cause: DOMPurify afterSanitizeAttributes hook was treating verstak:// links as blocked because hash-based href didnt match ALLOWED_SCHEMES regex. Fix: 1. afterSanitizeAttributes hook now checks data-verstak-href first and returns early for internal links - they never get blocked 2. Changed href from hash-based to about:blank (safe value that DOMPurify wont strip, unlike javascript:void(0)) 3. Click handler already uses data-verstak-href, not href Added unit test: markdown.test.js (27 tests for renderer.link output)
29 lines
988 B
HTML
29 lines
988 B
HTML
<!DOCTYPE html>
|
|
<html lang="ru">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<link rel="icon" type="image/png" sizes="16x16" href="/assets/app-icons/icon_16x16.png" />
|
|
<link rel="icon" type="image/png" sizes="32x32" href="/assets/app-icons/icon_32x32.png" />
|
|
<link rel="icon" type="image/png" sizes="64x64" href="/assets/app-icons/icon_64x64.png" />
|
|
<link rel="icon" type="image/png" sizes="128x128" href="/assets/app-icons/icon_128x128.png" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
<title>Верстак</title>
|
|
<style>
|
|
/* Critical reset — no white borders, full viewport */
|
|
html, body, #app {
|
|
width: 100%;
|
|
height: 100%;
|
|
margin: 0;
|
|
padding: 0;
|
|
overflow: hidden;
|
|
background: #13131f;
|
|
}
|
|
</style>
|
|
<script type="module" crossorigin src="/assets/main-BpXZraKT.js"></script>
|
|
<link rel="stylesheet" crossorigin href="/assets/main-bQpH1es2.css">
|
|
</head>
|
|
<body>
|
|
<div id="app"></div>
|
|
</body>
|
|
</html>
|