From 4c10490e0488b03de70a6e0d7d7432347dcce00a Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 10 Apr 2026 09:48:44 +0300 Subject: processor: document trusted inbox trust boundary for markdown HTML Markdown uses goldmark html.WithUnsafe for intentional raw HTML in personal-inbox posts. Package and processMd comments state the trust model and warn against untrusted input on the same path. Made-with: Cursor --- internal/processor/markdown.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'internal/processor/markdown.go') diff --git a/internal/processor/markdown.go b/internal/processor/markdown.go index 8d69bfe..e09cf59 100644 --- a/internal/processor/markdown.go +++ b/internal/processor/markdown.go @@ -17,7 +17,10 @@ import ( // We use it to discover local asset references that must be copied. var imageRefPattern = regexp.MustCompile(`!\[[^\]]*\]\(([^)]+)\)`) -// processMd converts a Markdown file to an HTML snippet. +// processMd converts a Markdown file to an HTML snippet for a trusted inbox source. +// The markdown (including any raw HTML blocks) is treated as author-controlled +// content, not user-generated input from strangers; see the package comment. +// // Returns the HTML and a list of local image filenames referenced in the document. // Referenced images that exist alongside the source file are returned so the // caller can copy them into the post asset directory. @@ -33,7 +36,8 @@ func processMd(path string) (htmlContent string, localImages []string, err error md := goldmark.New( goldmark.WithExtensions(extension.GFM), goldmark.WithRendererOptions( - html.WithUnsafe(), // Allow raw HTML in markdown (user-controlled content). + // Trusted inbox: preserve raw HTML in markdown (see package comment). + html.WithUnsafe(), ), ) -- cgit v1.2.3