mirror of
https://github.com/discourse/discourse.git
synced 2026-08-05 19:38:04 +08:00
49474b0188#39133 backslash-escaped markdown characters in upload filenames at generation time. That worked for freshly uploaded files but exposed a latent bug in the rich-editor round-trip: markdown-it kept `\_` in the parsed image token's content, ProseMirror stored it verbatim in the `alt` attribute, and on save the serializer re-escaped each `\` to `\\`. Every edit doubled the backslashes (1 → 2 → 4 → … → 2^N) until the post exceeded `max_post_length` and became uneditable. Escaping the raw is fundamentally fragile — nothing treats the stored raw as canonical, so any parse/serialize cycle either drops the escape or re-applies it. Fix it at parse time instead: - Revert the generation-side escaping from #39133 in `UploadMarkdown`, `uploads.js`, `inline_uploads.rb`, `to-markdown.js` and `sanitizeAlt`. - Add a `literalize_upload_labels` core ruler in the markdown-it engine. After inline parsing runs, it walks `image` / `link_open` tokens whose URL starts with `upload://` and collapses their children into a single literal text token, rebuilt from the children `content` plus the `markup` of emphasis/strong/strikethrough delimiters. So `_foo_`, `**foo**`, `~~foo~~`, `` `foo` ``, `\_foo`, linkified URLs, hashtags and mentions inside upload labels all render literally. Reference-style links (`[label][ref]` with `[ref]: upload://…`) get the same treatment for free since they go through the same tokens. The raw now stays canonical: the filename goes in verbatim, cooks the same way on every pass, and the textarea and rich editor round-trip identically. Because escaping is gone, the structural characters `[`, `]` and `|` (which would break the link/image syntax and can't be escaped without reintroducing the doubling) are stripped from labels at every generation point — `UploadMarkdown`, the HTML-anchor and hotlinked-image conversions in `inline_uploads.rb`, `uploads.js` and `to-markdown.js`. The multi-token scan-forward in `renderAttachment` (engine.js) and in ProseMirror's `link.js` parser is kept: it still matters for non-upload attachment links like `[**bold**|attachment](https://example.com/x.pdf)`, where the label legitimately contains inline formatting the new ruler doesn't touch. `StripUploadLabelEscapes` (post-deploy migration) heals posts already damaged by the regression, batching a scoped `regexp_replace` across the `posts` table. The lookahead `(?=[^\]\[]*\]\(upload://)` bounds each match to an upload label — forbidding `[`/`]` between the escape and the closing `](upload://` keeps user-written `\_` escapes elsewhere in the raw intact. Scoping on the lookahead alone, rather than anchoring on the opening `[`, lets a single pass strip every escape in a label (e.g. `foo\_bar\_baz`), not just the first. https://meta.discourse.org/t/401231
46 lines
1.5 KiB
Ruby
Vendored
46 lines
1.5 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
class UploadMarkdown
|
|
def initialize(upload)
|
|
@upload = upload
|
|
end
|
|
|
|
def to_markdown(display_name: nil)
|
|
if FileHelper.is_supported_image?(@upload.original_filename)
|
|
image_markdown(display_name: display_name)
|
|
elsif FileHelper.is_supported_playable_media?(@upload.original_filename)
|
|
playable_media_markdown(display_name: display_name)
|
|
else
|
|
attachment_markdown(display_name: display_name)
|
|
end
|
|
end
|
|
|
|
def image_markdown(display_name: nil)
|
|
""
|
|
end
|
|
|
|
def attachment_markdown(display_name: nil, with_filesize: true)
|
|
human_filesize = with_filesize ? " (#{@upload.human_filesize})" : ""
|
|
"[#{display_label(display_name)}|attachment](#{@upload.short_url})#{human_filesize}"
|
|
end
|
|
|
|
def playable_media_markdown(display_name: nil)
|
|
type =
|
|
if FileHelper.is_supported_audio?(@upload.original_filename)
|
|
"audio"
|
|
elsif FileHelper.is_supported_video?(@upload.original_filename)
|
|
"video"
|
|
end
|
|
return attachment_markdown if !type
|
|
""
|
|
end
|
|
|
|
private
|
|
|
|
# `[`, `]` and `|` would break the link/image syntax, and escaping them would
|
|
# reintroduce the rich-editor backslash doubling this whole change removes, so
|
|
# strip them from the label instead.
|
|
def display_label(display_name)
|
|
(display_name || @upload.original_filename).to_s.gsub(/[\[\]\|]/, "")
|
|
end
|
|
end
|
