Repository navigation
Keep the ids a document links to - #5
Merged
Merged
Conversation
The sanitizer allowed `class` and nothing else on a generic element, so every `id` was stripped before the converter ran. An `<a href="#x">` survived — `href` is allowed on `a` — and pointed at nothing, which made any document carrying its own table of contents come out with every entry dead. Hand the same HTML to weasyprint directly and it writes a named destination; hand it through here and it writes none. `id` carries no script and no navigation of its own. DOM clobbering is a browser concern, and this HTML only ever reaches a document converter. Measured on a 16-page card exported from Klaro: 7 link annotations and no destination table before, 43 annotations and 22 named destinations after — one per heading. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
`dir` was stripped like every other generic attribute, so a renderer that marks its output `dir="auto"` — markdown-it-bidi does, and Klaro ships it — had the mark removed and Arabic or Hebrew came out laid out as if it were English: flush left, in a paragraph that should run right to left. `bdo` was already an allowed tag and means nothing at all without `dir`. Like `id`, it carries no script and no navigation; it only says which way a paragraph runs. Rendered a mixed Arabic / Hebrew / English document through the service before and after: the two right-to-left paragraphs move to the right margin, the English one stays where it was. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The sanitizer allowed
classand nothing else on a generic element, so everyidwas stripped before the converter ran. An<a href="#x">survived —hrefis allowed ona— and pointed at nothing, which made any document carrying its own table of contents come out with every entry dead. Hand the same HTML to weasyprint directly and it writes a named destination; hand it through here and it writes none.idcarries no script and no navigation of its own. DOM clobbering is a browser concern, and this HTML only ever reaches a document converter.Measured on a 16-page card exported from Klaro: 7 link annotations and no destination table before, 43 annotations and 22 named destinations after — one per heading.