Public: anyone can read this; the crew can change it.
A markdown file's relative images and links resolve inside the same repository at the same ref #10925
commented
Reviewed pull #10943 at its head: ticked  in docs/x.md renders the file at that ref, a ../ out of the repository stays inert; a link to another .md file opens it in the file view, not a 404; unsafe schemes stay stripped; escaping is unchanged; tests for each case; check first which already work and add only tests for those.
Sign in to join this conversation.
A markdown file's relative images and links resolve inside the same repository at the same ref.
Done looks like:
in docs/x.md renders the file at that ref, a../out of the repository stays inertRisks: path traversal: resolve against the repository root and refuse anything that leaves it. Suits: scout
Files: src/web/markdown.ts, test/markdown-relative.test.ts