self-hosted/joplin
1
0
Fork 0
mirror of https://github.com/laurent22/joplin.git synced 2024-12-24 10:27:10 +02:00
Code Issues Releases Activity

Electron: Allow HTML in Markdown documents in a secure way

Browse Source
This commit is contained in:
Laurent Cozic 2018-06-22 18:18:15 +00:00
parent 6d8941c005
commit df302206dd
4 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ElectronClient/app/gui/NoteText.jsx
View File

@ -1282,7 +1282,7 @@ class NoteTextComponent extends React.Component {
const viewer = <webview
style={viewerStyle}
nodeintegration="1"
preload="gui/note-viewer/preload.js"
src="gui/note-viewer/index.html"
ref={(elem) => { this.webview_ref(elem); } }
/>

1
ElectronClient/app/gui/note-viewer/index.html
View File

@ -34,7 +34,6 @@
<div id="content" ondragstart="return false;" ondrop="return false;"></div>
<script>
const { ipcRenderer } = require('electron');
const contentElement = document.getElementById('content');
// ----------------------------------------------------------------------

4
ElectronClient/app/gui/note-viewer/preload.js Normal file
View File

@ -0,0 +1,4 @@
// Define here Electron objects that need to be accessed from the WebView
// https://github.com/electron/electron/blob/master/docs/tutorial/security.md#2-disable-nodejs-integration-for-remote-content
window.ipcRenderer = require('electron').ipcRenderer;

6
ReactNativeClient/lib/MdToHtml.js
View File

@ -216,7 +216,7 @@ class MdToHtml {
if (isInlineCode) {
openTag = null;
} else if (tag && t.type.indexOf('html_inline') >= 0) {
} else if (tag && (t.type.indexOf('html_inline') >= 0 || t.type.indexOf('html_block') >= 0)) {
openTag = null;
} else if (tag && t.type.indexOf('_open') >= 0) {
openTag = tag;
@ -277,7 +277,7 @@ class MdToHtml {
if (t.type === 'image') {
if (tokenContent) attrs.push(['title', tokenContent]);
output.push(this.renderImage_(attrs, options));
} else if (t.type === 'html_inline') {
} else if (t.type === 'html_inline' || t.type === 'html_block') {
output.push(t.content);
} else if (t.type === 'softbreak') {
output.push('<br/>');
@ -392,7 +392,7 @@ class MdToHtml {
const md = new MarkdownIt({
breaks: true,
linkify: true,
html: false, // For security, HTML tags are not supported - https://github.com/laurent22/joplin/issues/500
html: true,
});
// This is currently used only so that the $expression$ and $$\nexpression\n$$ blocks are translated