forked from fa/breadcrumb-the-shire
35 lines
1010 B
PHP
35 lines
1010 B
PHP
<?php
|
|
|
|
namespace MintyPHP\Module\Security\Service;
|
|
|
|
use League\CommonMark\GithubFlavoredMarkdownConverter;
|
|
|
|
/**
|
|
* Renders check-template Markdown guidance to sanitized HTML.
|
|
*
|
|
* Hardened config: raw HTML in the source is escaped (html_input=escape) and
|
|
* unsafe links (javascript:, data:, …) are dropped (allow_unsafe_links=false),
|
|
* so author-entered content can never inject markup/script into the workspace.
|
|
*
|
|
* @api Consumed by the security check workspace action to pre-render per-item guidance.
|
|
*/
|
|
final class SecurityMarkdownGateway
|
|
{
|
|
private ?GithubFlavoredMarkdownConverter $converter = null;
|
|
|
|
public function toHtml(string $markdown): string
|
|
{
|
|
$markdown = trim($markdown);
|
|
if ($markdown === '') {
|
|
return '';
|
|
}
|
|
|
|
$this->converter ??= new GithubFlavoredMarkdownConverter([
|
|
'html_input' => 'escape',
|
|
'allow_unsafe_links' => false,
|
|
]);
|
|
|
|
return (string) $this->converter->convert($markdown);
|
|
}
|
|
}
|