feat(reader): render GFM with an explicit document security boundary #4
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/MarkdownViewr.Windows#4
Reference in new issue
Block a user
Implement the real Markdown rendering foundation for the Windows viewer, preserving GitHub Flavored Markdown while treating document-authored HTML and URLs as untrusted.
Use centrally pinned Markdig 1.4.0 (BSD-2-Clause) and HtmlSanitizer 9.2.1039 (MIT), verified from NuGet and their primary documentation. The parser alone is not an HTML security boundary.
Acceptance: GFM tables/tasks/strikethrough/fenced code/autolinks; preserve useful safe HTML; remove executable elements, handlers, document styles, unsafe schemes and native host capability; force rendered task controls to be disabled checkboxes; bound document input; add malicious-content and concurrent rendering regression tests with full core coverage; record WebView2 origin/CSP/resource/bridge policy before connecting user documents to UI.
This is an implementation step toward #1, not a completed Windows port. UI integration, safe local resources and all other reference features remain in scope. Substantial AI assistance: Codex (GPT-6).
Signed/DCO commit
f1756d21edis pushed in draft PR #3.The first reader now replaces the greeting/crash controls: Windows picker/Ctrl+O, literal launch file, GFM rendering and manual reload. Added explicit HTML sanitation, script/native-capability denial, resource interception, and final image-handle containment. Core: 56 passing tests at 100% measured line coverage. Native file adapter: six passing tests, including an actual outside-root junction. Zero-warning build, format, docs lint and commit hooks pass.
Actual browser acceptance remains pending: desktop reservation was requested, and hosted current-head jobs have started. No screenshots or browser security acceptance are claimed yet. Keep this issue open until acceptance is demonstrated. Full port scope in #1, production signing and release publication remain separate unfinished work.
Current-head hosted update: security run 38098965817 passed. Scripts run 38098965365 failed inside Invoke-ScriptAnalyzer 1.25.0 with a null-reference engine exception, not reported lint findings; no scripts/settings/workflow were changed by the reader implementation. A separate CI issue tracks remediation; no run was restarted and the required gate remains enforced. CI 38098965780 and CodeQL 38098965738 are still running, including actual document UI acceptance.
Signed/DCO commit
09d14e6b78is pushed in draft PR #3.Automatic reload now uses a debounced containing-directory subscription, handles replacement/rename/deletion/recreation, retains the last readable snapshot, and retries brief editor locks. Relative scroll preservation matches the reference's behavior when document height changes. Core scheduling keeps picker selections and coalesces save notifications.
Local proof: zero-warning build; 82 core tests at 100% measured line coverage; 12 real native file/watcher tests; formatting/docs/hooks pass. New browser save/recovery/lock/scroll/network tests await exact-head hosted results. No local GUI input run or screenshot is claimed.
Previous reader
f1756d2fully passed hosted CI including 13 native/UI tests and both installed update channels; CodeQL/security also passed. PSScriptAnalyzer engine crash remains open in #5. Keep #4/#6 open pending their new browser scenarios; full scope in #1 remains unfinished. No failed run restarted, no merge or release published.Scoped reader/security acceptance is verified on signed head
77dd04da96: CI 38102249889 SUCCESS, 26/26 native/UI, 26/26 published, 25/25 installed stable and 25/25 installed dev, no skips. Core renderer/resource-policy tests and 100% coverage pass; actual script stripping, remote-image denial and physical image containment are exercised. CodeQL/security passed.Evidence is retained locally in artifacts/verified-reader-38102249889 (TRX, update JSON, byte gates and fixture screenshots). This scoped issue can close when its reviewed PR merges. The full application remains tracked in #1; new outline/frontmatter checks and production signing are separate outstanding work.