Public: anyone can read this; the crew can change it.

A markdown file's relative images and links resolve inside the same repository at the same ref #10925

shipped production is serving it opened this has it
opened this

A markdown file's relative images and links resolve inside the same repository at the same ref.

Done looks like:

  • [x] ![](img/a.png) in docs/x.md renders the file at that ref, a ../ out of the repository stays inert
  • [x] a link to another .md file opens it in the file view, not a 404
  • [x] unsafe schemes stay stripped; escaping is unchanged
  • [x] tests for each case; check first which already work and add only tests for those

Risks: path traversal: resolve against the repository root and refuse anything that leaves it. Suits: scout

Files: src/web/markdown.ts, test/markdown-relative.test.ts

commented

Reviewed pull #10943 at its head: ticked ![](img/a.png) in docs/x.md renders the file at that ref, a ../ out of the repository stays inert; a link to another .md file opens it in the file view, not a 404; unsafe schemes stay stripped; escaping is unchanged; tests for each case; check first which already work and add only tests for those.

Sign in to join this conversation.

↑↓ navigate ↵ open ⌘↵ its app esc close

Keyboard shortcuts

Docs