Angle brackets are stripped instead of escaped in comments

[e0qdk]

Angle brackets are improperly stripped out of comments in mlmym. It seems likely that this is from trying to prevent HTML injection. The correct behavior is not to strip such text out, but to ensure the characters are properly escaped (e.g. as < and >) so they are not interpreted as HTML tags.

[e0qdk]

This is likely a mismatch between Markdown as implemented by lemmy-ui (via markdown-it?) and what goldmark does when not allowing unsafe HTML. I expect there ought to be a way to get goldmark to escape HTML-like tags instead of replacing the text with <!-- raw HTML omitted --> but it's not clear to me how to do this from their documentation. (May need an extension?)

Some links I made note of while digging into this -- maybe useful for future reference:

• lemmy-ui's markdown code: https://github.com/LemmyNet/lemmy-ui/blob/main/src/shared/markdown.ts
• Possibly related issue in lemmy-ui (although recent versions don't seem to have this problem any more?): Angle brackets (and the content that they enclose) get deleted when you submit a post with them LemmyNet/lemmy-ui#2067
• goldmark: https://github.com/yuin/goldmark
• goldmark test site: https://yuin.github.io/goldmark/playground/
• CommonMark test site: https://spec.commonmark.org/dingus

[MrKaplan-lw]

the commonmark test site simply passes on the html tags, which is the same behavior that happens with goldmark when using unsafe mode.

lemmy-ui disables html in markdown-it: https://github.com/LemmyNet/lemmy-ui/blob/0.19.11/src/shared/markdown.ts#L164
https://markdown-it.github.io/markdown-it/#MarkdownIt.new

markdown-it test site: https://markdown-it.github.io/

it seems that markdown-it simply escapes html instead of replacing it with an html comment. this would likely be a breaking change in goldmark to implement, but it might be something to upstream as an option?

https://github.com/yuin/goldmark/blob/31bbeb28fd68f795f8890542359fb5090e3adc81/renderer/html/html.go#L375-L399

if they don't want that in the core then an extension is probably the way to go.