From e239c8596135d3774c957e7f0042f2ca4a65d37f Mon Sep 17 00:00:00 2001
From: Peter Meier <peter.meier.1986@gmail.com>
Date: Thu, 28 May 2026 13:14:58 +0200
Subject: [PATCH] feat(markdown): span[style] in Markdown erlauben, alles
 andere HTML strippen

---
 src/lib/markdown-safe.ts | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/lib/markdown-safe.ts b/src/lib/markdown-safe.ts
index eba4d91..deec436 100644
--- a/src/lib/markdown-safe.ts
+++ b/src/lib/markdown-safe.ts
@@ -23,9 +23,18 @@ function configure() {
   marked.setOptions({ gfm: true });
   marked.use({
     renderer: {
-      // Inline raw HTML: `<...>` → bleibt wörtlich als Text stehen.
-      html() {
-        return '';
+      // Allow only <span style="..."> and </span> — strip all other raw HTML.
+      html(token: { text: string }) {
+        let s = token.text;
+        // Protect <span style="…"> (style value must not contain < or >)
+        s = s.replace(/<span\s+style="([^"<>]{0,400})"\s*>/gi, '\x00span:$1\x00');
+        s = s.replace(/<\/span>/gi, '\x00/span\x00');
+        // Strip all remaining HTML tags
+        s = s.replace(/<[^>]+>/g, '');
+        // Restore safe spans
+        s = s.replace(/\x00span:([^\x00]*)\x00/g, '<span style="$1">');
+        s = s.replace(/\x00\/span\x00/g, '</span>');
+        return s;
       },
     },
   });