| 1 | import ReactMarkdown, { defaultUrlTransform } from "react-markdown"; |
| 2 | import rehypeRaw from "rehype-raw |
| 3 | import rehypeSanitize, { defaultSchema |
| 4 | import remarkGfm from "remark-gfm |
| 5 | |
| 6 | import { remarkReferences } |
| 7 | import { cn } |
| 8 | |
| 9 | // we override some default tagNames to offer some flexibility |
| 10 | const SCHEMA = { |
| 11 | ...defaultSchema, |
| 12 | attributes: { |
| 13 | ...defaultSchema.attributes, |
| 14 | // `target` and `rel` are kept so a README can open a link in a new tab; the anchor component below is what makes `_blank` safe. |
| 15 | a: [ |
| 16 | ...(defaultSchema.attributes |
| 17 | ["target", "_blank" |
| 18 | "rel", |
| 19 | ], |
| 20 | // `align` becomes `style="text-align:<value>"` after sanitizing, so anything but the four legal values is a CSS injection. This is the last point where it is still an attribute. |
| 21 | "*": [ |
| 22 | ...(defaultSchema.attributes |
| 23 | (attribute) => |
| 24 | ), |
| 25 | ["align", "left" |
| 26 | ["vAlign", "top" |
| 27 | ], |
| 28 | }, |
| 29 | tagNames: [ |
| 30 | ...(defaultSchema.tagNames |
| 31 | "abbr", |
| 32 | "caption", |
| 33 | "center", |
| 34 | "figcaption", |
| 35 | "figure", |
| 36 | "mark", |
| 37 | "small", |
| 38 | "time", |
| 39 | ], |
| 40 | }; |
| 41 | |
| 42 | export function Markdown({ |
| 43 | children, |
| 44 | className, |
| 45 | resolveUrl, |
| 46 | repository, |
| 47 | }: { |
| 48 | children: string |
| 49 | className?: string |
| 50 | resolveUrl?: ( |
| 51 | /** Where issue and pull request text lives; set, `#1`, `owner/repo#1` and `@user` become links. */ |
| 52 | repository?: { |
| 53 | }) { |
| 54 | return ( |
| 55 | <div |
| 56 | className={cn( |
| 57 | "text-sm wrap-break-word", |
| 58 | "[&_p]:block", |
| 59 | "[&_h1]:mt-4 [&_h1]:mb-2 [&_h1]:text-lg [&_h1]:font-semibold", |
| 60 | "[&_h2]:mt-4 [&_h2]:mb-2 [&_h2]:text-base [&_h2]:font-semibold", |
| 61 | "[&_h3]:mt-3 [&_h3]:mb-1.5 [&_h3]:font-semibold", |
| 62 | "[&_ul]:my-2 [&_ul]:list-disc [&_ul]:pl-5", |
| 63 | "[&_ol]:my-2 [&_ol]:list-decimal [&_ol]:pl-5", |
| 64 | "[&_li]:my-0.5", |
| 65 | "[&_a]:text-primary [&_a]:underline", |
| 66 | "[&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_code]:font-mono [&_code]:text-xs", |
| 67 | "[&_pre]:my-2 [&_pre]:overflow-x-auto [&_pre]:rounded-lg [&_pre]:border [&_pre]:bg-muted/50 [&_pre]:p-3", |
| 68 | "[&_pre_code]:bg-transparent [&_pre_code]:p-0", |
| 69 | "[&_blockquote]:my-2 [&_blockquote]:border-l-2 [&_blockquote]:pl-3 [&_blockquote]:text-muted-foreground", |
| 70 | "[&_hr]:my-4 [&_hr]:border-t", |
| 71 | "[&_img]:max-w-full [&_img]:rounded", |
| 72 | "[&_table]:my-2 [&_table]:block [&_table]:overflow-x-auto [&_th]:border [&_th]:px-2 [&_th]:py-1 [&_th]:text-left [&_td]:border [&_td]:px-2 [&_td]:py-1", |
| 73 | "[&_li:has(input)]:list-none [&_li_input]:mr-1.5 [&_ul:has(input)]:pl-1", |
| 74 | className, |
| 75 | )} |
| 76 | > |
| 77 | <ReactMarkdown |
| 78 | remarkPlugins={ |
| 79 | repository ? [remarkGfm |
| 80 | } |
| 81 | rehypePlugins={[rehypeRaw, |
| 82 | components={{ |
| 83 | a({ node, |
| 84 | return ( |
| 85 | <a |
| 86 | {...props} |
| 87 | target={target} |
| 88 | rel={target === |
| 89 | className={cn(" |
| 90 | /> |
| 91 | ); |
| 92 | }, |
| 93 | }} |
| 94 | urlTransform={ |
| 95 | resolveUrl && |
| 96 | ((url, key |
| 97 | const safe = |
| 98 | return isRelative(safe |
| 99 | }) |
| 100 | } |
| 101 | > |
| 102 | {children} |
| 103 | </ReactMarkdown> |
| 104 | </div> |
| 105 | ); |
| 106 | } |
| 107 | |
| 108 | /** `rel` with `noopener noreferrer` added, keeping whatever the author wrote. A `_blank` link hands the opener to the page it opens without it. */ |
| 109 | function noopener(rel: |
| 110 | return [...new |
| 111 | .filter(Boolean) |
| 112 | .join(" ") |
| 113 | } |
| 114 | |
| 115 | /** Anything that is not an absolute URL, a protocol-relative one, or an anchor. */ |
| 116 | function isRelative(url: |
| 117 | return url !== |
| 118 | } |