search

CATcher-org / CATcher

CATcher is a software application used for peer-testing of software projects.
https://catcher-org.github.io/CATcher/
MIT License
70 stars 68 forks source link

Markdown preview and actual content may differ #1214

Closed chunweii closed 7 months ago

chunweii commented 11 months ago

Describe the bug For example, this is the raw issue comment (see https://github.com/chunweii/alpha8/issues/1):

> quote stops working in preview???

> quote with &lt;br/&gt; <br/> 
> new quote

> another quote like `this`

In preview mode, the following is displayed: image

After submitting, the markdown is displayed as such: image

Possible cause Before the preview is displayed, the contents are sanitized using DOMPurify.sanitize(text) in comment-editor.component. However, during the submission of the form, the input is not sanitized. Similarly, the contents are not sanitized before being displayed when it is not in preview mode.

Possible solutions

  1. Remove DOMPurify.sanitize. The ngx-markdown component by default sanitizes the contents (See the docs)

  2. Alternatively, use DOMPurify.sanitize before uploading the contents to github. The downside is the user might see a different text if they want to edit it again. For example, it could be changed to:

    
&gt; quote stops working in preview???

> quote with <br/>
> new quote

> another quote like this