Repository navigation
feat(markdown): 内嵌 SVG 按白名单保留绘图元素，脚本、外部引用和 style 仍被剥离 - #32
Merged
Merged
Conversation
markdown.render 的 Ammonia 过滤器放行 SVG 的图形、文字、use、image、渐变、图案、裁剪、蒙版、标记和不加载外部资源的滤镜，以及它们的几何与展示属性；script、foreignObject、style 元素、动画元素、feImage 和 style 属性仍被剥离，use/textPath 只能引用本文档的 #id。共享 fixture markdown-render-v1.json 增加内嵌 SVG 用例，Core 新增测试跑完整份 fixture。
xiaoyumuxi
marked this pull request as ready for review
November 14, 2026 04:30
This was referenced Nov 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
关联
桌面端 Markdown 预览改用 web view（Lithe-IDEA 的 Draft PR，随后补链接）。预览要显示 README 里的内嵌
<svg>，过滤器需要放行它。改动
markdown.render的 Ammonia 过滤器放行 SVG 的绘图元素：svg、g、defs、symbol、use、title、desc、各类图形、text/tspan/textPath、image、线性/径向渐变、stop、pattern、clipPath、mask、marker、filter，以及不加载外部资源的滤镜原语（feGaussianBlur、feOffset、feColorMatrix等）。这些元素都带上几何属性和展示属性（viewBox、d、fill、stroke-*、transform、text-anchor等）。script、foreignObject、style元素、动画元素（animate、set等）、feImage、style属性、事件属性、javascript:等危险 URL。use和textPath的href只能是本文档的#id，引用外部文件时直接去掉。image的href照常走 Ammonia 的 URL scheme 检查。<svg>切换到 SVG 命名空间，这条由 Ammonia 的命名空间检查保证，所以<svg><iframe>…一类的变异 XSS 仍被拒绝。style仍不开放，沿用 #1623 的决定；SVG 的颜色和线条改由展示属性表达。rust/fixtures/editor/markdown-render-v1.json新增用例“inline SVG draws without scripts or external references”。新增 Rust 测试satisfies_shared_render_fixture跑完整份 fixture，以前这份 fixture 只有桌面端在跑。另有inline_svg_keeps_drawing_and_drops_what_runs_or_embeds覆盖textPath、image、feImage、set和style元素。rust/contracts/rust-core-api.md的“Markdown rendering”一节写明 SVG 放行与剥离的范围。验证
cargo test -p lithe-project --lib markdown：8 个测试全部通过cargo fmt -p lithe-project、cargo clippy -p lithe-project --all-targets -- -D warnings：通过不涉及插件契约、能力版本或插件函数协议，所以不需要更新协议记录。