feat(markdown): span[style] in Markdown erlauben, alles andere HTML strippen

2026-05-28 13:14:58 +02:00
parent 28170a8549
commit e239c85961
1 changed files with 12 additions and 3 deletions
@@ -23,9 +23,18 @@ function configure() {
  marked.setOptions({ gfm: true });
  marked.use({
    renderer: {
-      // Inline raw HTML: `<...>` → bleibt wörtlich als Text stehen.
-      html() {
-        return '';
+      // Allow only <span style="..."> and </span> — strip all other raw HTML.
+      html(token: { text: string }) {
+        let s = token.text;
+        // Protect <span style="…"> (style value must not contain < or >)
+        s = s.replace(/<span\s+style="([^"<>]{0,400})"\s*>/gi, '\x00span:$1\x00');
+        s = s.replace(/<\/span>/gi, '\x00/span\x00');
+        // Strip all remaining HTML tags
+        s = s.replace(/<[^>]+>/g, '');
+        // Restore safe spans
+        s = s.replace(/\x00span:([^\x00]*)\x00/g, '<span style="$1">');
+        s = s.replace(/\x00\/span\x00/g, '</span>');
+        return s;
      },
    },
  });