[pull] develop from marktext:develop - #114
Merged
Merged
Conversation
A CommonMark autolink's href is the literal text between `< >`, which the author has already percent-encoded (e.g. `%20`). The renderer ran it through `encodeURI`, re-encoding the `%` and turning `%20` into `%2520`, so the followed link pointed at the wrong URL. Standard `[text](url)` links never encode the href, so autolinks now match by using it verbatim. Fixes #3548 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Pasting a same-kind list into a non-last item scrambled order: both merge paths pushed the pasted items onto the END of the enclosing list's children instead of inserting them right after the anchor item. Pasting `- 1/- 2/- 3` onto the empty middle item of `- A/- /- B` produced `- A/- 1/- B/- 2/- 3`. Splice the pasted items in after the anchor item, and — since they are no longer the list's last descendant — seat the caret on the last pasted item explicitly. Extracted the post-rebuild caret placement into `seatListMergeCursor` to keep `tryMergeListPaste` within the complexity budget. Fixes #3549 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ecution) (#4843) * feat(common): add isDangerousExecutableFile guard Add a pure extension-based check (and the backing extension list) for files the OS shell would execute as code — Windows Script Host scripts (js, vbs, wsf, hta…), native executables/installers, batch, PowerShell, and shortcut/ registry/JVM launchers. Case-insensitive; no filesystem access so it can gate a decision before the file is opened. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(desktop): confirm before opening executable link targets Clicking a markdown link to a co-located local file called shell.openPath with no safety check. On Windows a link like `[open](./update.js)` next to an untrusted document ran the script through wscript.exe with no prompt, giving silent code execution. Guard the non-markdown local-file branch of mt::format-link-click with isDangerousExecutableFile and show a warning dialog (default Cancel) before opening; the file is only handed to the OS shell if the user confirms. Fixes #3575 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(common): harden isDangerousExecutableFile (review #4843) Two gaps from review: - Trailing dot/space bypass: `update.js.` and `<./update.js >` (an angle- bracket link skips the space rejection) reach the guard with an extension of `.` / `js ` that isn't listed, yet Windows strips trailing dots/spaces during ShellExecute and still runs `update.js`. Trim trailing `[ .]+` before reading the extension. - Windows-only coverage: the vulnerable shell.openPath path is cross-platform, so add macOS (`command`, `app`) and Linux (`desktop`, `appimage`, `run`) launchers — `[x](./run.command)` / `./launch.desktop` reproduced #3575 off Windows. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * i18n: add unsafe-file dialog strings to all locales Add dialog.unsafeFileTitle / unsafeFileMessage / unsafeFileDetail ({name}) and dialog.openAnyway to the ten locale files so the #3575 confirmation dialog is localized (getTranslation returns the raw key when one is missing). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(desktop): localize the unsafe-file confirmation dialog (review #4843) Route the dialog title/message/detail and buttons through t('dialog.…') instead of hardcoded English, matching the other dialogs in this file. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A soft line break (Shift+Enter, serialized as a bare `\n` inside a block) shows as a line break in the editor (`.mu-content` is pre-wrap) but was lost on export: marked renders a soft break as a space, so the two lines ran together in the exported HTML/PDF. Instead of forcing marked to emit `<br>` (which CommonMark reserves for hard breaks — it would make the exported HTML non-conformant), keep the conformant `\n` and render it the way the editor does, with `white-space: pre-wrap` in exportStyle.css: - `.markdown-body p` covers paragraphs, blockquotes and loose list items (whose content is wrapped in `<p>`). - `.markdown-body li:not(:has(> p))` covers tight list items, whose soft break is a bare `\n` directly inside the `<li>`. Loose items are excluded so marked's pretty-printing newline between `</p>` and `</li>` is not exposed as a stray blank line — no DOM post-processing needed. The exported HTML now matches the editor while staying CommonMark-conformant (soft break = line ending; hard breaks still `<br>`). Verified in real Chromium that the paragraph and tight-item breaks render and the loose item has no stray blank line. Fixes #3676 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…4850) An escaped pipe inside a table cell's inline code (`` `\|` ``) was displayed with the backslash — `\|` — instead of the intended `|`. GFM escapes a literal `|` in a table cell as `\|`; once the table is parsed that escape is a literal pipe, so `` `\|` `` must render as `<code>|</code>` (which the HTML/PDF export already does). On import, `restoreTableEscapeCharacters` re-added the `\|` escape into the stored cell text. Outside code the backslash rule hides it, but inside inline code (where escapes don't apply) the backslash leaked into the display. That re-escaping was also redundant: `stateToMarkdown.escapeText` already re-escapes unescaped `|` in a cell on serialization. Store the cell text as marked emits it (escape already resolved to `|`) and let `escapeText` re-add the escape on the way out. The editor now shows the pipe correctly and the markdown still round-trips to `` `\|` ``. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… (#4846) A fenced code block's info string was reduced to its first word on save: only `meta.lang` (used for syntax highlighting) was kept, and the serializer emitted just that word. So ```` ```{example, listing1-name} ```` was rewritten to ```` ```{example, ```` — and ```` ```js title="app.js" ```` lost its attributes — the moment the document was saved. `meta.lang` must stay a single word: the code-block content adds a `language-${lang}` class and a lang with spaces would break `classList.add`. So preserve the full info string additively in a new optional `meta.info`, set at parse time when the info string carries more than the language word, and emit it on serialize. The language word still drives highlighting; the fence now round-trips losslessly. Serialization only trusts `meta.info` while `lang` is still its first word, so editing the language (which rewrites `lang`) correctly drops the stale attributes instead of re-emitting them. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )