2 files changed, 67 insertions, 0 deletions
diff --git a/internal/markdown/render.go b/internal/markdown/render.go
new file mode 100644
index 0000000..f9a2bfd
--- /dev/null
+++ b/internal/markdown/render.go
@@ -0,0 +1,38 @@
+// Package markdown renders untrusted Markdown to sanitized HTML.
+package markdown
+
+import (
+	"bytes"
+
+	"github.com/microcosm-cc/bluemonday"
+	"github.com/yuin/goldmark"
+	"github.com/yuin/goldmark/extension"
+	"github.com/yuin/goldmark/parser"
+	"github.com/yuin/goldmark/renderer/html"
+)
+
+var md = goldmark.New(
+	goldmark.WithExtensions(extension.GFM, extension.Typographer),
+	goldmark.WithParserOptions(parser.WithAutoHeadingID()),
+	goldmark.WithRendererOptions(html.WithHardWraps(), html.WithUnsafe()), // unsafe output is sanitized below
+)
+
+var policy = func() *bluemonday.Policy {
+	p := bluemonday.UGCPolicy()
+	p.AllowAttrs("id").OnElements("h1", "h2", "h3", "h4", "h5", "h6")
+	p.AllowAttrs("class").Matching(bluemonday.SpaceSeparatedTokens).OnElements("code", "pre", "span", "div", "table", "input", "li", "ul")
+	p.AllowAttrs("type", "checked", "disabled").OnElements("input")
+	p.AllowAttrs("align").OnElements("th", "td")
+	p.AllowAttrs("width", "height").OnElements("img")
+	p.RequireNoFollowOnLinks(false)
+	return p
+}()
+
+// Render converts Markdown to HTML that is safe to embed unescaped.
+func Render(src string) string {
+	var buf bytes.Buffer
+	if err := md.Convert([]byte(src), &buf); err != nil {
+		return "<p>(could not render content)</p>"
+	}
+	return policy.Sanitize(buf.String())
+}
diff --git a/internal/markdown/render_test.go b/internal/markdown/render_test.go
new file mode 100644
index 0000000..7240afc
--- /dev/null
+++ b/internal/markdown/render_test.go
@@ -0,0 +1,29 @@
+package markdown
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRenderSanitizes(t *testing.T) {
+	out := Render("# Hi\n\n**bold** <script>alert(1)</script> <a href=\"javascript:alert(1)\">x</a> <img src=\"/media/abc\" onerror=\"x()\">")
+	for _, bad := range []string{"<script", "javascript:", "onerror"} {
+		if strings.Contains(out, bad) {
+			t.Errorf("output contains %q: %s", bad, out)
+		}
+	}
+	for _, good := range []string{"<h1", "<strong>bold</strong>", `<img src="/media/abc"`} {
+		if !strings.Contains(out, good) {
+			t.Errorf("output missing %q: %s", good, out)
+		}
+	}
+}
+
+func TestRenderGFM(t *testing.T) {
+	out := Render("| a | b |\n|---|---|\n| 1 | 2 |\n\nline one\nline two\n\nhttps://example.org")
+	for _, want := range []string{"<table>", "<br>", `<a href="https://example.org"`} {
+		if !strings.Contains(out, want) {
+			t.Errorf("output missing %q: %s", want, out)
+		}
+	}
+}