jcoffey-dev
15f2c3d357
A .md previewed as its own source, which is reading the punctuation rather than the notes. It now opens rendered, with Rendered | Source in the dialog footer for anyone who wants what the file actually says. Markdown only; a .txt has nothing to toggle between. Rendering is `marked`, sanitised by DOMPurify -- the one the app already carries for mail. Markdown is not a safe subset of anything: raw HTML passes through it by design, so a <script> in a file somebody uploaded or shared into the account is a script tag unless something takes it out. Images become links rather than pictures. An image in a Markdown file is either a relative path, which has no base to resolve against here, or a URL somewhere else, which fetches on open and tells that server the file was read -- the tracking pixel this app blocks in mail. The link keeps the alt text and the address, so nothing vanishes silently. Fixes the PDF preview while here, which never worked: securityHeaders put X-Frame-Options: DENY on every response including the blob route, so the iframe showed Chrome's "refused to connect" where the file should have been -- in Files today and in mail attachments long before that. The middleware now leaves a header the route has set, and a PDF served inline says SAMEORIGIN. Nothing else on the server is framable.
35 lines
846 B
JSON
35 lines
846 B
JSON
{
|
|
"name": "@ihasmail/web",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"license": "AGPL-3.0-or-later",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -p tsconfig.json --noEmit && vite build",
|
|
"preview": "vite preview",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
"test": "vitest run"
|
|
},
|
|
"dependencies": {
|
|
"@tanstack/react-virtual": "^3.13.2",
|
|
"dompurify": "^3.2.4",
|
|
"lucide-react": "^0.477.0",
|
|
"marked": "^18.0.11",
|
|
"qrcode-generator": "^2.0.4",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"wouter": "^3.6.0",
|
|
"zustand": "^5.0.3"
|
|
},
|
|
"devDependencies": {
|
|
"@types/react": "^19.0.10",
|
|
"@types/react-dom": "^19.0.4",
|
|
"@vitejs/plugin-react": "^4.3.4",
|
|
"jsdom": "^26.0.0",
|
|
"typescript": "^5.7.3",
|
|
"vite": "^6.2.0",
|
|
"vitest": "^3.0.8"
|
|
}
|
|
}
|