Removed remark-html in favor of Rehype #119
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mgc1194
commented
Apr 4, 2024
Comment on lines
+14
to
+49
| // create custom sanitization schema as per | ||
| // https://github.com/syntax-tree/hast-util-sanitize#schema | ||
| // to support our custom syntaxes | ||
| const schema = Object.assign({}, defaultSanitizationSchema); | ||
| schema.clobber = []; | ||
|
|
||
| // We use a _lot_ of image formatting stuff in our | ||
| // instructions, particularly in CSP | ||
| schema.attributes.img.push("height", "width"); | ||
|
|
||
| // Add support for expandableImages | ||
| schema.tagNames.push("span"); | ||
| schema.attributes.span = ["dataUrl", "className"]; | ||
|
|
||
| // Add support for inline styles (gross) | ||
| // TODO replace all inline styles in our curriculum content with | ||
| // semantically-significant content | ||
| schema.attributes["*"].push("style", "className"); | ||
|
|
||
| // ClickableText uses data-id on a bold tag. | ||
| schema.attributes["b"] = ["dataId"]; | ||
|
|
||
| // Add support for Blockly XML | ||
| const blocklyTags = [ | ||
| "block", | ||
| "functional_input", | ||
| "mutation", | ||
| "next", | ||
| "statement", | ||
| "title", | ||
| "field", | ||
| "value", | ||
| "xml", | ||
| ]; | ||
| schema.tagNames = schema.tagNames.concat(blocklyTags); | ||
|
|
There was a problem hiding this comment.
This is the same schema used in SafeMarkdown in our main repo.
There was a problem hiding this comment.
Optional/nit: I wonder if we should make SafeMarkdown use this schema so that it's sourced in one location.
There was a problem hiding this comment.
It would be great to have just one source for our custom schema. Here is a ticket to track that work: P20-858
mgc1194
commented
Apr 4, 2024
| "rehype-raw": "^5.1.0", | ||
| "rehype-sanitize": "^4.0.0", | ||
| "rehype-stringify": "^8.0.0", | ||
| "remark-parse": "^6.0.3", |
There was a problem hiding this comment.
We can't use versions above 7 so I went with the most used version (6.0.4) immediately below. Tests start breaking after version 8, and version 9 of the remak/rehype environments has major changes that make upgrading way more difficult as explained in this comment.
stephenliang
approved these changes
Apr 4, 2024
Comment on lines
+14
to
+49
| // create custom sanitization schema as per | ||
| // https://github.com/syntax-tree/hast-util-sanitize#schema | ||
| // to support our custom syntaxes | ||
| const schema = Object.assign({}, defaultSanitizationSchema); | ||
| schema.clobber = []; | ||
|
|
||
| // We use a _lot_ of image formatting stuff in our | ||
| // instructions, particularly in CSP | ||
| schema.attributes.img.push("height", "width"); | ||
|
|
||
| // Add support for expandableImages | ||
| schema.tagNames.push("span"); | ||
| schema.attributes.span = ["dataUrl", "className"]; | ||
|
|
||
| // Add support for inline styles (gross) | ||
| // TODO replace all inline styles in our curriculum content with | ||
| // semantically-significant content | ||
| schema.attributes["*"].push("style", "className"); | ||
|
|
||
| // ClickableText uses data-id on a bold tag. | ||
| schema.attributes["b"] = ["dataId"]; | ||
|
|
||
| // Add support for Blockly XML | ||
| const blocklyTags = [ | ||
| "block", | ||
| "functional_input", | ||
| "mutation", | ||
| "next", | ||
| "statement", | ||
| "title", | ||
| "field", | ||
| "value", | ||
| "xml", | ||
| ]; | ||
| schema.tagNames = schema.tagNames.concat(blocklyTags); | ||
|
|
There was a problem hiding this comment.
Optional/nit: I wonder if we should make SafeMarkdown use this schema so that it's sourced in one location.
8 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Story
DependaBot marked a few dependencies in this repo as high or critical. In addition, we are updating with similar changes, the remark-plugins repo.
This PR does:
remark-parse,unified,unist-util-select,remark-stringify.remark-htmlrehype-raw,rehype-sanitize,rehype-stringifyandremark-rehype. (Note that more recent versions of the unified ecosystem are only ESM compatible)RedactableMarkdownProcessorusing rehype libraries instead of remark-html as we do in our main repo.\nintroduced byremak-html(We no longer use remark-html)After the update only two high-severity dependencies are left:
However we don't use this library on our server side, therefore this vulnerability can't be exploited.