* feat(mermaid): 新增 mermaid 懒加载 chunk(构建链四处同步 + mermaid 依赖) tsdown CHUNKS / bundle-route CHUNK_NAMES / chunk-loader ChunkName / package.json files 同步注册 mermaid chunk;mermaid ^11.16.1 进依赖与 lockfile;chunk 构建注入 uuid 浏览器入口别名,绕开 node:crypto 纯度门。 * feat(mermaid): Markdown 预览安全渲染 mermaid 图表 + 点击放大弹窗 - splitMermaidBlocks 纯函数按 fence 切块,无 mermaid 文件零行为变化; - mermaid.initialize 走 securityLevel strict + htmlLabels:false,不应用 bindFunctions(静态图);渲染 SVG 经 mermaid-sanitize 二次清洗: 删 foreignObject/script/外来 HTML 元素、剥 @*/on* 属性、移除全部 href/xlink:href,仅接受 SVG 根,解析失败返回空串; - 点击图表弹出放大弹窗(滚轮缩放/拖拽平移/快捷键,借鉴 PR #75 交互, 基于已清洗 SVG 克隆重写,不新增攻击面); - 深浅色跟随重渲、失败回退错误条 + 原码、CodeBlock 同款 chrome。 * test(mermaid): splitter/sanitize 单测 + chunk 清单同步 + 挂载冒烟 diagram.md - mermaid-blocks.spec 10 例 fence 切块语义; - mermaid-sanitize.spec 8 例 XSS(foreignObject/on*/@*/href/xlink:href/ script/外来元素/畸形 XML/非 SVG 根); - bundle-route / chunk-artifact / manifest-consistency 清单加入 mermaid (chunk-artifact 补 addEventListener stub); - 挂载冒烟新增 diagram.md:client-mermaid.js 往返、SVG 节点文字、 点击弹窗 Esc 关闭、preview 模式编辑器隐藏。 * docs(mermaid): 安全渲染设计文档 + lazy-chunks 表 + README 双语更新 设计文档记录基线决策(PR #99 架构 + PR #75 点击放大)、安全模型 (strict/htmlLabels/清洗/href 剥离/无 bindFunctions)、验证与取舍。 * fix(mermaid): sanitizer 属性名大小写归一,堵住混合大小写属性绕过(CR P1) XML 属性名保留大小写,而输出会经 HTML 解析归一化(dangerouslySetInnerHTML), oNload/HREF/xlink:HREF 这类混合大小写属性此前会漏过清洗。比较前先 toLowerCase(),按原名删除;新增混合大小写事件/链接属性回归用例。 * fix(mermaid): sanitizer 元素黑名单大小写归一,堵住混合大小写元素绕过(CR P1) XML 元素名保留大小写,querySelectorAll('script') 等选择器匹配不到 <sCrIpT>/<foreignobject>,而输出经 HTML 解析会被归一化为 SVG script/foreignObject(可执行/可注入 HTML)。改为遍历全部元素按 localName.toLowerCase() 命中小写黑名单后整节点删除;新增混合大小写 script/foreignObject/外来 HTML 元素回归用例(jsdom 实证:旧选择器 命中 0,新逻辑命中 2)。 * fix(mermaid): 单次 Markdown 解析 + 占位交换(CR P1)+ CommonMark fence 规则(CR P2) P1(跨 fence 语义):弃用逐块 MarkdownText 拆分,改为整篇文档单次 MarkdownText 渲染,布局后把 language-mermaid 代码块交换为 MermaidDiagram (React 管理的 .md-code-block 宿主保留在树中、display:contents 抑制盒子, 协调安全;块不再 mermaid 时还原原 children)。新增 tests/mermaid-markdown.spec.tsx 与 e2e 跨 fence 引用链接断言。 P2(fence 匹配):支持 3+ 反引号与波浪号开 fence;闭 fence 须同字符且 长度不小于开 fence;反引号 info string 含反引号不视为开 fence;修复 带缩进开 fence 的 info 提取。blocks 单测 +3 例。
85 lines
3.2 KiB
TypeScript
85 lines
3.2 KiB
TypeScript
/**
|
|
* MermaidMarkdown architecture spec: the preview renders the WHOLE document
|
|
* through one MarkdownText pass (cross-fence reference-style links must
|
|
* resolve — the P1 regression from the CR), then swaps every rendered
|
|
* mermaid CodeBlock for a diagram. mermaid is mocked so the swap + semantics
|
|
* are asserted without pulling the real layout engine into jsdom.
|
|
*/
|
|
// @vitest-environment jsdom
|
|
import { describe, expect, it, vi, beforeEach } from 'vitest'
|
|
import { createElement } from 'react'
|
|
import { createRoot, type Root } from 'react-dom/client'
|
|
import { act } from 'react-dom/test-utils'
|
|
|
|
// The act() environment flag (React 18.2 reads it before flushing effects).
|
|
;(globalThis as Record<string, unknown>).IS_REACT_ACT_ENVIRONMENT = true
|
|
|
|
vi.mock('mermaid', () => ({
|
|
default: {
|
|
initialize: () => {},
|
|
render: async () => ({
|
|
svg: '<svg xmlns="http://www.w3.org/2000/svg"><text>MOCK-DIAGRAM</text></svg>',
|
|
}),
|
|
},
|
|
}))
|
|
|
|
import { MermaidMarkdown } from '../src/client/mermaid.tsx'
|
|
|
|
const codeLabels = { copyLabel: 'Copy', copiedLabel: 'Copied' }
|
|
|
|
async function renderMarkdown(text: string): Promise<{ container: HTMLElement; root: Root }> {
|
|
const container = document.createElement('div')
|
|
document.body.appendChild(container)
|
|
const root = createRoot(container)
|
|
await act(async () => {
|
|
root.render(createElement(MermaidMarkdown, { text, codeLabels }))
|
|
// Let the mocked mermaid.render promise settle inside the act scope.
|
|
await new Promise(resolve => { setTimeout(resolve, 0) })
|
|
})
|
|
return { container, root }
|
|
}
|
|
|
|
async function unmount(root: Root): Promise<void> {
|
|
await act(async () => { root.unmount() })
|
|
}
|
|
|
|
beforeEach(() => {
|
|
document.body.innerHTML = ''
|
|
})
|
|
|
|
describe('MermaidMarkdown', () => {
|
|
it('swaps the mermaid code block for a rendered diagram', async () => {
|
|
const { container, root } = await renderMarkdown('```mermaid\ngraph TD\n A-->B\n```')
|
|
const diagram = container.querySelector('[data-mermaid-diagram] svg')
|
|
expect(diagram, 'the mermaid fence must be swapped for a diagram').not.toBeNull()
|
|
expect(diagram?.textContent).toContain('MOCK-DIAGRAM')
|
|
await unmount(root)
|
|
})
|
|
|
|
it('resolves cross-fence reference-style links (single markdown parse)', async () => {
|
|
const text = [
|
|
'[before][shared]',
|
|
'',
|
|
'```mermaid',
|
|
'graph TD',
|
|
' A --> B',
|
|
'```',
|
|
'',
|
|
'[shared]: https://example.com',
|
|
].join('\n')
|
|
const { container, root } = await renderMarkdown(text)
|
|
const link = container.querySelector('a[href="https://example.com"]')
|
|
expect(link, 'the definition after the fence must resolve the link before it').not.toBeNull()
|
|
expect(link?.textContent).toContain('before')
|
|
expect(container.querySelector('[data-mermaid-diagram] svg'), 'the diagram must still swap in').not.toBeNull()
|
|
await unmount(root)
|
|
})
|
|
|
|
it('leaves non-mermaid fences untouched', async () => {
|
|
const { container, root } = await renderMarkdown('```ts\nconst a = 1\n```')
|
|
expect(container.querySelector('[data-mermaid-diagram]'), 'no mermaid fence → no swap').toBeNull()
|
|
expect(container.querySelectorAll('.md-code-block').length, 'the ts fence stays a code block').toBe(1)
|
|
await unmount(root)
|
|
})
|
|
})
|