[6.x, 7.x] A Markdown link prevents showing URLs with the unsafe protocol

[gucchy55]

Environment

Host

item	version
OS	Docker image
GROWI	6.3.5
node.js	18.20.3
npm	10.7.0
Using Docker	yes
Using growi-docker-compose	yes

(Accessing https://{GROWI_HOST}/admin helps you to fill in above versions)

Client

item	version
OS	macOS Sonoma / Windows 10/11
browser	Google Chrome 130.0.6723.117

How to reproduce? (再現手順)

1. Put a Markdown link with an "lw" protocol such as: [Markdown link](lw://path/to/dir)

What happens? (症状)

The rendered html does not contain the href attribute value: <a href>"Markdown link"</a>

What is the expected result? (期待される動作)

The rendered html contains the href attribute value: <a href="lw://path/to/dir">Markdown link</a>

Note

• I am using an "lw" link to open the file path with a filer application.
• The link worked with Growi: 5.1.6 as expected.

[yuki-takei]

It seems to be prevented by remark-js/react-markdown.
ref: safeProtocol

[gucchy55]

Is it difficult to enable customization for unsafe protocols for security reasons or others?
Growi 6.3.5 looks using react-markdown 8.0.7 in which the protocols look defined at:
https://github.com/remarkjs/react-markdown/blob/4a6065ba509f1232b94d3b79b6d426626aede6d2/lib/uri-transformer.js#L1

[yuki-takei]

It might be possible to customize it by setting the urlTransform option, but the team does not prioritize this.