fix: fix markdown embed image issue #857
Conversation
|
Hi, thanks for the contribution. The security model of markdowns in gotify is it should at least not XSS. This seems to me will allow It seems like the discussion you quoted says you should use defaultUrlTransform by default and explicitly handle other known good cases if needed. |
|
Understood, this indeed poses some security concerns. So, if we specially handle embedded image URLs and use defaultUrlTransform for non-image URLs, would this approach work? Related PR: mlflow/mlflow#16761 (comment) |
|
Nice find, that should do it. I would match a semicolon after that as well just in case. |
|
Done, and I also agree to include the semicolon in the match. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #857 +/- ##
=======================================
Coverage 78.76% 78.76%
=======================================
Files 56 56
Lines 2670 2670
=======================================
Hits 2103 2103
Misses 476 476
Partials 91 91 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Thanks! Works for me as well.
CC: @MnM001 I think this should help your use case as well. You can use the command line to base64 encode the image straight in the message.
ui/src/common/Markdown.tsx
Outdated
| // Copy from mlflow/server/js/src/shared/web-shared/genai-markdown-renderer/GenAIMarkdownRenderer.tsx | ||
| // Related PR: https://github.com/mlflow/mlflow/pull/16761 | ||
| const urlTransform: UrlTransform = (value) => { | ||
| if (value.startsWith('data:image/png;') || value.startsWith('data:image/jpeg;')) { |
There was a problem hiding this comment.
In the gotify/android we support a few more formats, maybe we could add image/gif here too? This seems like a commonly used format. For the rest we can wait until someone reports an issue.
|
Good point! I've added support for GIFs — that seems like a sensible addition. We can wait for further reports before adding more formats. |
3 participants
The new version of react-markdown cannot display images in the embed format. This issue can be fixed by following the method provided in the corresponding repository. Related issue: remarkjs/react-markdown#774 (comment).