details element parsed as string not HTML

[miketaylr]

https://staging.webcompat.com/issues/1489

[miketaylr]

I'll investigate, but if this is semi-complicated, we should just remove details and use a markdown header.

[miketaylr]

On GitHub

[miketaylr]

Hm.

[miketaylr]

Ah, I think it's just being sanitized to a string. Let's see if we can hack it.

[Regaddi]

Phew. It's basically mixed Github flavoured Markdown with HTML in it. This might be tricky.

[Regaddi]

Seems like https://github.com/svbergerem/markdown-it-sanitizer is not maintained anymore. I'm currently reaching out to @svbergerem to clarify.

Basically <details> and <summary> is not on the list of accepted tags.
Suggested this in svbergerem/markdown-it-sanitizer#8.
But also a PR adding flexibility to this is failing.
Let's see what happens.

[svbergerem]

@Regaddi No, the project is not dead. I'm not aware of any bugs and I didn't have enough time to implement new features. I already planned a bigger refactoring in 2016 that would allow adding and removing accepted tags. I just started working on the project again and I'll let you know when there is anything new.

[karlcow]

Just to note that markdown allows inline HTML. It's a feature. :)

[miketaylr]

Just to note that markdown allows inline HTML. It's a feature. :)

Yes, but we use the sanitizer to restrict what's allowed. Lots of scary things can sneak into valid HTML.

[miketaylr]

@Regaddi showed me a workaround that we could ship until the sanitizer lib is updated, I might have some time to work on that tonight (before he wakes up), since I'm just hanging out at an AirBNB away from my family.

[miketaylr]

I might have some time to work on that tonight (before he wakes up)

(probably not happening tonight!)

my idea was to essentially create a new file in the /static/js/lib/mixin directory, something like allowlist.js, then include it into the comment and issue model files similar to

webcompat.com/webcompat/static/js/lib/issue-list.js

Line 262 in cb766b2

_.extend({}, issuesPagination, {

.

I think that's probably better than forking the sanitizer lib, short-term.