From df302206ddefae9b9e6164c16dcb501dc1c02b5e Mon Sep 17 00:00:00 2001
From: Laurent Cozic <laurent@cozic.net>
Date: Fri, 22 Jun 2018 18:18:15 +0000
Subject: [PATCH] Electron: Allow HTML in Markdown documents in a secure way

---
 ElectronClient/app/gui/NoteText.jsx           | 2 +-
 ElectronClient/app/gui/note-viewer/index.html | 1 -
 ElectronClient/app/gui/note-viewer/preload.js | 4 ++++
 ReactNativeClient/lib/MdToHtml.js             | 6 +++---
 4 files changed, 8 insertions(+), 5 deletions(-)
 create mode 100644 ElectronClient/app/gui/note-viewer/preload.js

diff --git a/ElectronClient/app/gui/NoteText.jsx b/ElectronClient/app/gui/NoteText.jsx
index 690375daf..b985ed464 100644
--- a/ElectronClient/app/gui/NoteText.jsx
+++ b/ElectronClient/app/gui/NoteText.jsx
@@ -1282,7 +1282,7 @@ class NoteTextComponent extends React.Component {
 
 		const viewer =  <webview
 			style={viewerStyle}
-			nodeintegration="1"
+			preload="gui/note-viewer/preload.js"
 			src="gui/note-viewer/index.html"
 			ref={(elem) => { this.webview_ref(elem); } }
 		/>
diff --git a/ElectronClient/app/gui/note-viewer/index.html b/ElectronClient/app/gui/note-viewer/index.html
index 04eb84b81..764307e60 100644
--- a/ElectronClient/app/gui/note-viewer/index.html
+++ b/ElectronClient/app/gui/note-viewer/index.html
@@ -34,7 +34,6 @@
 	<div id="content" ondragstart="return false;" ondrop="return false;"></div>
 
 	<script>
-	const { ipcRenderer } = require('electron');
 	const contentElement = document.getElementById('content');
 
 	// ----------------------------------------------------------------------
diff --git a/ElectronClient/app/gui/note-viewer/preload.js b/ElectronClient/app/gui/note-viewer/preload.js
new file mode 100644
index 000000000..c78fc386e
--- /dev/null
+++ b/ElectronClient/app/gui/note-viewer/preload.js
@@ -0,0 +1,4 @@
+// Define here Electron objects that need to be accessed from the WebView
+// https://github.com/electron/electron/blob/master/docs/tutorial/security.md#2-disable-nodejs-integration-for-remote-content
+
+window.ipcRenderer = require('electron').ipcRenderer;
\ No newline at end of file
diff --git a/ReactNativeClient/lib/MdToHtml.js b/ReactNativeClient/lib/MdToHtml.js
index ac6b99576..de2afd527 100644
--- a/ReactNativeClient/lib/MdToHtml.js
+++ b/ReactNativeClient/lib/MdToHtml.js
@@ -216,7 +216,7 @@ class MdToHtml {
 
 			if (isInlineCode) {
 				openTag = null;
-			} else if (tag && t.type.indexOf('html_inline') >= 0) {
+			} else if (tag && (t.type.indexOf('html_inline') >= 0 || t.type.indexOf('html_block') >= 0)) {
 				openTag = null;
 			} else if (tag && t.type.indexOf('_open') >= 0) {
 				openTag = tag;
@@ -277,7 +277,7 @@ class MdToHtml {
 			if (t.type === 'image') {
 				if (tokenContent) attrs.push(['title', tokenContent]);
 				output.push(this.renderImage_(attrs, options));
-			} else if (t.type === 'html_inline') {
+			} else if (t.type === 'html_inline' || t.type === 'html_block') {
 				output.push(t.content);
 			} else if (t.type === 'softbreak') {
 				output.push('<br/>');
@@ -392,7 +392,7 @@ class MdToHtml {
 		const md = new MarkdownIt({
 			breaks: true,
 			linkify: true,
-			html: false, // For security, HTML tags are not supported - https://github.com/laurent22/joplin/issues/500
+			html: true,
 		});
 
 		// This is currently used only so that the $expression$ and $$\nexpression\n$$ blocks are translated