Renders untrusted markdown into a typed tree that cannot carry markup.
Message bodies are attacker-controlled. In the CLI they land in a terminal; in a webview they land somewhere that can execute code, and a sender who achieves script execution there is inside the trust boundary and can read and exfiltrate every conversation. That is strictly worse than compromising the relay, which only ever sees ciphertext.
So this crate never produces an HTML string. It produces [Node] and
[Inline] values that a renderer maps to elements, which means there
is no string for an injection to hide in and no innerHTML at the far
end. Three rules do the work:
- Raw HTML is text, not markup.
pulldown-cmarkemits embedded HTML as its own event; those become [Inline::Text] verbatim. A body containing<script>renders those characters on screen. - Link targets are allowlisted to
http,https, andmailto. Anything else (javascript:,data:,vbscript:,file:) loses its link and keeps its text, so the content survives and the navigation does not. - Remote images are not fetched. This is privacy, not just
safety: an inlined remote image is a read receipt telling the
sender when you opened a message and from which IP. They arrive as
[
ImageSource::Blocked] for the UI to offer as click-to-load.