| 1 | import { |
| 2 | Info, |
| 3 | Lightbulb, |
| 4 | type LucideIcon, |
| 5 | MessageSquareWarning, |
| 6 | OctagonAlert, |
| 7 | TriangleAlert, |
| 8 | } from "lucide-react"; |
| 9 | import ReactMarkdown, { defaultUrlTransform |
| 10 | import rehypeRaw from "rehype-raw |
| 11 | import rehypeSanitize, { defaultSchema |
| 12 | import remarkGemoji from "remark-gemoji |
| 13 | import remarkGfm from "remark-gfm |
| 14 | |
| 15 | import { HighlightedCode } |
| 16 | import { ALERTS, remarkAlerts |
| 17 | import { remarkReferences } |
| 18 | import { cn } |
| 19 | |
| 20 | const SCHEMA = { |
| 21 | ...defaultSchema, |
| 22 | attributes: { |
| 23 | ...defaultSchema.attributes, |
| 24 | // `target` and `rel` are kept so a README can open a link in a new tab; the anchor component below is what makes `_blank` safe. |
| 25 | a: [ |
| 26 | ...(defaultSchema.attributes |
| 27 | ["target", "_blank" |
| 28 | "rel", |
| 29 | ], |
| 30 | // the classes `remarkAlerts` puts on an alert and its title, and nothing else |
| 31 | div: [ |
| 32 | ...(defaultSchema.attributes |
| 33 | [ |
| 34 | "className", |
| 35 | "markdown-alert", |
| 36 | ...Object.keys( |
| 37 | ], |
| 38 | ], |
| 39 | p: [ |
| 40 | ...(defaultSchema.attributes |
| 41 | ["className", "markdown-alert-title" |
| 42 | ], |
| 43 | // `align` becomes `style="text-align:<value>"` after sanitizing, so anything but the four legal values is a CSS injection. This is the last point where it is still an attribute. |
| 44 | "*": [ |
| 45 | ...(defaultSchema.attributes |
| 46 | (attribute) => |
| 47 | ), |
| 48 | ["align", "left" |
| 49 | ["vAlign", "top" |
| 50 | ], |
| 51 | }, |
| 52 | tagNames: [ |
| 53 | ...(defaultSchema.tagNames |
| 54 | "abbr", |
| 55 | "caption", |
| 56 | "center", |
| 57 | "figcaption", |
| 58 | "figure", |
| 59 | "mark", |
| 60 | "small", |
| 61 | "time", |
| 62 | ], |
| 63 | }; |
| 64 | |
| 65 | const ALERT_ICONS: Record |
| 66 | Note: Info, |
| 67 | Tip: Lightbulb, |
| 68 | Important: MessageSquareWarning, |
| 69 | Warning: TriangleAlert, |
| 70 | Caution: OctagonAlert, |
| 71 | }; |
| 72 | |
| 73 | export function Markdown({ |
| 74 | children, |
| 75 | className, |
| 76 | resolveUrl, |
| 77 | repository, |
| 78 | }: { |
| 79 | children: string |
| 80 | className?: string |
| 81 | resolveUrl?: ( |
| 82 | /** Where issue and pull request text lives; set, `#1`, `owner/repo#1` and `@user` become links. */ |
| 83 | repository?: { |
| 84 | }) { |
| 85 | return ( |
| 86 | <div className={cn |
| 87 | <ReactMarkdown |
| 88 | remarkPlugins={ |
| 89 | // Issue, pull request and comment text breaks lines on every newline, as on GitHub; a README does not. |
| 90 | repository |
| 91 | ? [ |
| 92 | remarkGfm, |
| 93 | remarkGemoji, |
| 94 | remarkAlerts, |
| 95 | remarkBreaks, |
| 96 | [remarkReferences, repository] |
| 97 | ] |
| 98 | : [remarkGfm, remarkGemoji |
| 99 | } |
| 100 | rehypePlugins={[rehypeRaw, |
| 101 | components={{ |
| 102 | a({ node, |
| 103 | return ( |
| 104 | <a |
| 105 | {...props} |
| 106 | target={target} |
| 107 | rel={target === |
| 108 | /> |
| 109 | ); |
| 110 | }, |
| 111 | code({ node, |
| 112 | // only a fenced block names its language; inline code and unlabelled blocks stay as written |
| 113 | const language = |
| 114 | return language && |
| 115 | <HighlightedCode |
| 116 | code={children.replace |
| 117 | language={language} |
| 118 | /> |
| 119 | ) : ( |
| 120 | <code {...props |
| 121 | {children} |
| 122 | </code> |
| 123 | ); |
| 124 | }, |
| 125 | p({ node, |
| 126 | const Icon = |
| 127 | className === "markdown-alert-title" |
| 128 | ALERT_ICONS[children as |
| 129 | return ( |
| 130 | <p {...props |
| 131 | {Icon && <Icon |
| 132 | {children} |
| 133 | </p> |
| 134 | ); |
| 135 | }, |
| 136 | }} |
| 137 | urlTransform={ |
| 138 | resolveUrl && |
| 139 | ((url, key |
| 140 | const safe = |
| 141 | return isRelative(safe |
| 142 | }) |
| 143 | } |
| 144 | > |
| 145 | {children} |
| 146 | </ReactMarkdown> |
| 147 | </div> |
| 148 | ); |
| 149 | } |
| 150 | |
| 151 | /** `rel` with `noopener noreferrer` added, keeping whatever the author wrote. A `_blank` link hands the opener to the page it opens without it. */ |
| 152 | function noopener(rel: |
| 153 | return [...new |
| 154 | .filter(Boolean) |
| 155 | .join(" ") |
| 156 | } |
| 157 | |
| 158 | /** Anything that is not an absolute URL, a protocol-relative one, or an anchor. */ |
| 159 | function isRelative(url: |
| 160 | return url !== |
| 161 | } |