max / makenotwork

1.9 KB · 36 lines History Blame Raw

1	//! Markdown rendering helpers for creator content.
2	//!
3	//! Wraps `docengine` with media URL rewriting so relative image/video
4	//! references in markdown (`![](folder/file.png)`) resolve to CDN URLs.
5	//!
6	//! Sanitization policy, deliberate: creator
7	//! markdown (blog posts, issues, project sections) is rendered via
8	//! `docengine::render_permissive`, which runs `ammonia` (strips script /
9	//! event-handlers / dangerous URL schemes) but PERMITS ordinary external
10	//! `http(s)`/`mailto` links, creators legitimately link out from prose. This is
11	//! intentionally MORE permissive than the custom-pages surface, which uses a
12	//! closed-system sanitizer restricting URLs to on-platform targets. Both paths are
13	//! XSS-safe; they differ only in whether external links are allowed, and that
14	//! difference is by design (long-form prose vs. a templated page builder). Keep the
15	//! two policies distinct rather than collapsing them.
16
17	use crate::db::UserId;
18
19	/// Render creator-authored markdown to HTML with media URL resolution.
20	///
21	/// Pipeline:
22	/// 1. Rewrite relative `![](path)` references to absolute CDN URLs
23	/// 2. Render markdown to HTML via `docengine::render_permissive`
24	/// 3. Strip off-platform media loads (tracking pixels) via
25	/// `docengine::restrict_media_hosts`
26	/// 4. Convert `<img>` tags with video extensions to `<video>` elements
27	pub fn render_creator_markdown(markdown: &str, user_id: UserId, cdn_base: &str) -> String {
28	let md = docengine::rewrite_media_paths(markdown, cdn_base, &user_id.to_string());
29	let html = docengine::render_permissive(&md);
30	// Strip off-platform media loads (tracking pixels) while keeping external
31	// text links, fuzz 2026-07-06 UX. Runs on the `<img>` output, before the
32	// img->video conversion. Relative + CDN-host media stay.
33	let html = docengine::restrict_media_hosts(&html, cdn_base);
34	docengine::img_to_video(&html)
35	}
36