/** * Simple Markdown Parser for Tinker Tickets * Supports basic markdown formatting without external dependencies */ function parseMarkdown(markdown) { if (!markdown) return ''; // Footnote labels are captured before the HTML-escape pass, so they must be // sanitized to a safe slug before being interpolated into id/href attributes // (otherwise a label like `x">` breaks out → stored XSS). var fnSlug = function (label) { return String(label).replace(/[^a-zA-Z0-9_-]/g, '-'); }; // Footnotes — collect definitions and mark references with placeholders // (must happen before HTML escaping so tags don't get escaped) const footnotes = {}; const footnoteOrder = []; const fnRefs = []; markdown = markdown.replace(/^\[\^([^\]]+)\]:\s+(.+)$/gm, function(_, label, text) { footnotes[label] = text; return ''; }); markdown = markdown.replace(/\[\^([^\]]+)\]/g, function(_, label) { if (!footnotes[label]) return '[^' + label + ']'; if (!footnoteOrder.includes(label)) footnoteOrder.push(label); const n = footnoteOrder.indexOf(label) + 1; fnRefs.push({ label, n }); return '%%FNREF' + (fnRefs.length - 1) + '%%'; }); let html = markdown; // Escape HTML first to prevent XSS. Quotes MUST be escaped too: user-controlled // text (e.g. image/link URLs and alt text) is later interpolated into "..." // attributes, so an unescaped " would break out and inject event handlers. html = html.replace(/&/g, '&') .replace(//g, '>') .replace(/"/g, '"') .replace(/'/g, '''); // Code blocks (```lang\ncode\n```) - preserve content and don't process further const codeBlocks = []; html = html.replace(/```([a-zA-Z0-9_+-]*)\n?([\s\S]*?)```/g, function(match, lang, code) { lang = lang ? lang.trim() : ''; const displayLang = lang || 'text'; // Build header with optional copy button if one exists in your UI, otherwise just lang const header = '
' + displayLang + '
'; // Remove exactly one trailing newline from code block if it exists if (code.endsWith('\n')) { code = code.slice(0, -1); } // Wrap in the specific UI classes expected by base.css codeBlocks.push('
' + header + '
' + code + '
'); return '%%CODEBLOCK' + (codeBlocks.length - 1) + '%%'; }); // Inline code (`code`) - preserve and don't process further const inlineCodes = []; html = html.replace(/`([^`]+)`/g, function(match, code) { inlineCodes.push('' + code + ''); return '%%INLINECODE' + (inlineCodes.length - 1) + '%%'; }); // Ticket references (#123456789) - convert to clickable links. // Runs AFTER code extraction so a literal #123456789 inside inline/fenced code // (now replaced by a placeholder) is not turned into a link. html = html.replace(/#(\d{9})\b/g, '#$1'); // Tables (must be processed before other block elements) html = parseMarkdownTables(html); // Emoji :name: — common set html = replaceEmoji(html); // Bold (**text** or __text__) html = html.replace(/\*\*(.+?)\*\*/g, '$1'); html = html.replace(/__(.+?)__/g, '$1'); // Italic (*text* or _text_) html = html.replace(/\*(.+?)\*/g, '$1'); html = html.replace(/_(.+?)_/g, '$1'); // Strikethrough (~~text~~) — must run before subscript (~) html = html.replace(/~~(.+?)~~/g, '$1'); // Highlight (==text==) html = html.replace(/==(.+?)==/g, '$1'); // Subscript H~2~O — single tilde (not preceded/followed by another tilde) html = html.replace(/(?$1'); // Superscript X^2^ — caret pair html = html.replace(/\^([^\^\n]+?)\^/g, '$1'); // Images ![alt](url) - must come before link handler html = html.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, function(match, alt, url) { if (/^https?:/i.test(url)) { return '' + alt + ''; } return match; }); // Links [text](url) - only allow safe protocols html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, function(match, text, url) { // Only allow http, https, mailto protocols if (/^(https?:|mailto:|\/)/i.test(url)) { return '' + text + ''; } // Block potentially dangerous protocols (javascript:, data:, etc.) return text; }); // Auto-link bare URLs (http, https) html = html.replace(/(?])(\bhttps?:\/\/[^\s<>\[\]()]+)/g, '$1'); // Headings with optional {#id} anchor — ### My Heading {#my-id} html = html.replace(/^(#{1,6})\s+(.+?)\s*(?:\{#([a-z0-9_-]+)\})?$/gm, function(match, hashes, text, id) { const level = hashes.length; const idAttr = id ? ' id="' + id + '"' : ''; return '' + text + ''; }); // Lists — tag each item type with a placeholder, then wrap consecutive runs html = html.replace(/^\s*\d+\.\s+(.+)$/gm, '%%OLI%%$1'); html = html.replace(/^\s*[-*+]\s+\[x\]\s+(.+)$/gim, '%%TDI%%$1'); html = html.replace(/^\s*[-*+]\s+\[ \]\s+(.+)$/gm, '%%TTI%%$1'); html = html.replace(/^\s*[-*+]\s+(.+)$/gm, '%%ULI%%$1'); // Wrap consecutive ordered items in
    html = html.replace(/(%%OLI%%.+(\n%%OLI%%.+)*)/g, function(block) { return '
      ' + block.replace(/%%OLI%%(.+)/g, '
    1. $1
      2. ') + '
    '; }); // Wrap consecutive unordered/task items in