security: Use commonmarkjs with {safe: true} as intended.

apps/api.json

@@ -1,5 +1,5 @@
 {
 	"type": "tildefriends-app",
 	"emoji": "📜",
-	"previous": "&miGORZ8BwjHg2YO0t4bms6SI28XWPYqnqOZ8u9zsbZc=.sha256"
+	"previous": "&BEf0nraBdHk/+PWqx6tOSu5rheWVaxaL7orAOz3285M=.sha256"
 }

apps/api/app.js

@@ -21,7 +21,7 @@ function* treeify(prefix, o) {
 
 function markdown(md) {
 	let parsed = new commonmark.Parser().parse(md ?? '*undocumented*');
-	return new commonmark.HtmlRenderer().render(parsed);
+	return new commonmark.HtmlRenderer({safe: true}).render(parsed);
 }
 
 function document(api) {

apps/blog.json

@@ -1,5 +1,5 @@
 {
 	"type": "tildefriends-app",
 	"emoji": "🪵",
-	"previous": "&TIrBnpN3iz3O9L9MCCteAcVJZjA83EKdcfu4SCM76VE=.sha256"
+	"previous": "&3jabNEk6W2uolzTvfXX6fcWF50N3501vtgZ6ZxFVJ1s=.sha256"
 }

apps/blog/blog.js

@@ -52,8 +52,8 @@ export async function get_blog_message(id) {
 }
 
 export function markdown(md) {
-	let reader = new commonmark.Parser({safe: true});
-	let writer = new commonmark.HtmlRenderer();
+	let reader = new commonmark.Parser();
+	let writer = new commonmark.HtmlRenderer({safe: true});
 	let parsed = reader.parse(md || '');
 	let walker = parsed.walker();
 	let event, node;

apps/issues.json

@@ -1,5 +1,5 @@
 {
 	"type": "tildefriends-app",
 	"emoji": "🦟",
-	"previous": "&cUqvSDUls3jn0haD85LPFAGdkc8wFuy347TtATNcJgg=.sha256"
+	"previous": "&4QfQjoCbdmCRu0nIBdOFiHBydYlDyyXrWqve6ELAmKA=.sha256"
 }

apps/issues/tf-utils.js

@@ -61,8 +61,8 @@ function image(node, entering) {
 }
 
 export function markdown(md) {
-	var reader = new commonmark.Parser({safe: true});
-	var writer = new commonmark.HtmlRenderer();
+	var reader = new commonmark.Parser();
+	var writer = new commonmark.HtmlRenderer({safe: true});
 	writer.image = image;
 	var parsed = reader.parse(md || '');
 	parsed = linkify.transform(parsed);

apps/journal.json

@@ -1,5 +1,5 @@
 {
 	"type": "tildefriends-app",
 	"emoji": "📝",
-	"previous": "&b//KqE4Vx6kOSBRODK1p/8wjOLKZJ+CBB5IkaBt5YsM=.sha256"
+	"previous": "&5LpOTEnor/rYFk3axyfmmehAoq9aEwNQRH4jwNhRQ7o=.sha256"
 }

apps/journal/tf-journal-entry.js

@@ -18,8 +18,8 @@ class TfJournalEntryElement extends LitElement {
 	}
 
 	markdown(md) {
-		var reader = new commonmark.Parser({safe: true});
-		var writer = new commonmark.HtmlRenderer();
+		var reader = new commonmark.Parser();
+		var writer = new commonmark.HtmlRenderer({safe: true});
 		var parsed = reader.parse(md || '');
 		return writer.render(parsed);
 	}

apps/ssb.json

@@ -1,5 +1,5 @@
 {
 	"type": "tildefriends-app",
 	"emoji": "🐌",
-	"previous": "&+UZSxjoucLAl5r/nfRNu5KXx3K/PdutGnizL/Cn2eCU=.sha256"
+	"previous": "&GDAJLaMKjeSXooWgpbw7G/40hgtRT1mYVK2twtEhWHA=.sha256"
 }

apps/ssb/tf-utils.js

@@ -81,8 +81,8 @@ function attrs(node) {
 }
 
 export function markdown(md) {
-	let reader = new commonmark.Parser({safe: true});
-	let writer = new commonmark.HtmlRenderer();
+	let reader = new commonmark.Parser();
+	let writer = new commonmark.HtmlRenderer({safe: true});
 	writer.image = image;
 	writer.code = code;
 	writer.attrs = attrs;

apps/wiki.json

@@ -1,5 +1,5 @@
 {
 	"type": "tildefriends-app",
 	"emoji": "📝",
-	"previous": "&DaYqKHRBKhjFGaOzbKZ1+/pLspJeEkDJYTF2B50tH6k=.sha256"
+	"previous": "&4F4D8+QlJVaxXywChQrNTdSV4Y3TvJ0xxqdq/i9HUWA=.sha256"
 }

apps/wiki/handler.js

@@ -2,8 +2,8 @@ import * as utils from './utils.js';
 import * as commonmark from './commonmark.min.js';
 
 function markdown(md) {
-	let reader = new commonmark.Parser({safe: true});
-	let writer = new commonmark.HtmlRenderer();
+	let reader = new commonmark.Parser();
+	let writer = new commonmark.HtmlRenderer({safe: true});
 	let parsed = reader.parse(md || '');
 	let walker = parsed.walker();
 	let event;

apps/wiki/tf-wiki-doc.js

@@ -20,8 +20,8 @@ class TfWikiDocElement extends LitElement {
 	}
 
 	markdown(md) {
-		let reader = new commonmark.Parser({safe: true});
-		let writer = new commonmark.HtmlRenderer();
+		let reader = new commonmark.Parser();
+		let writer = new commonmark.HtmlRenderer({safe: true});
 		let parsed = reader.parse(md || '');
 		let walker = parsed.walker();
 		let event;