ZacharyZhang-NYandClaude Opus 5.5
c5f614d095
Preview clicks and Cmd/Ctrl clicks in the editor go through one click handler; it stops the browser and sends the link mark's own address, since Milkdown blanks unsafe hrefs in the DOM. Reviews run at effort xhigh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 lines
962 B
Markdown
4 lines
962 B
Markdown
FAIL
|
|
|
|
- apps/ely-mark/web/src/visual.js:82: Plain preview clicks still bypass the required refusal policy when Milkdown sanitizes a link's scheme. Open `[local](file:///outside/file.md)` or `[data](data:text/plain,hello)` in preview and click it: the rendered anchor has `href=""`, so Chromium navigates to the bundled `index.html` instead of sending a link query. That URL passes `Surface::navigable`, so `Requests::on_before_browse` never queues `Event::Leave` and `MarkView::follow` never displays the refusal. Fresh-page Playwright probes reproduced the empty href, same-page navigation and zero link queries on native Windows and WSL; a WSL CEF off-screen probe also confirmed a user-initiated navigation to the bundled index. Intercept preview link activation before the browser default, apply the host policy to sanitized/empty addresses too, and add preview regression cases for these schemes; the current FTP-only refusal delivery coverage misses them.
|