ework-web 0.10.120 → 0.10.122

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ework-web",
-  "version": "0.10.120",
+  "version": "0.10.122",
   "type": "module",
   "description": "ework-web — standalone multi-project issue tracker. Local SQLite-backed, no external API dependency. Bun + TypeScript + SSR HTML.",
   "license": "MIT",

package/src/fileview.ts

@@ -1,5 +1,5 @@
 import { realpathSync, statSync, readFileSync, openSync, readSync, closeSync, readdirSync } from "fs";
-import { isAbsolute, relative, join, dirname } from "path";
+import { isAbsolute, relative, join, dirname, resolve } from "path";
 import hljs from "highlight.js";
 import { THEME_CSS, escapeHtml, escapeAttr } from "./render/layout";
 import { renderMarkdown } from "./render/markdown";
@@ -472,6 +472,32 @@ function buildDownloadView(cfg: Config, rp: string): { html: string } {
   return { html };
 }
 
+export // Repo-relative refs (figures/x.png) in /file-rendered markdown 404 against /file
+// (and DOMPurify strips relative src entirely); rewriting at markdown-source level
+// yields rooted /file URLs that survive sanitization and re-pass the gate at request time.
+const MD_REF_RE = /(\]\()([^)\s]+)([)\s])/g;
+const SKIP_REF_RE = /^(?:[a-z][a-z0-9+.-]*:|\/|#)/i;
+
+export function rewriteRelativeMdRefs(md: string, dir: string): string {
+  let out = "";
+  let last = 0;
+  for (const m of md.matchAll(/^(```|~~~)[^\n]*\n[\s\S]*?^\1[^\n]*$/gm)) {
+    out += rewriteRefs(md.slice(last, m.index!), dir) + m[0];
+    last = m.index! + m[0].length;
+  }
+  return out + rewriteRefs(md.slice(last), dir);
+}
+
+function rewriteRefs(text: string, dir: string): string {
+  return text.replace(MD_REF_RE, (full: string, pre: string, ref: string, post: string) => {
+    if (SKIP_REF_RE.test(ref) || ref.startsWith("/file")) return full;
+    const abs = resolve(dir, ref);
+    const media = /\.(?:png|jpe?g|gif|webp|bmp|svg|mp3|mp4|webm|ogg|wav|pdf)$/i.test(abs);
+    const url = `${media ? "/file/raw" : "/file"}?path=${encodeURIComponent(abs)}`;
+    return `${pre}${url}${post}`;
+  });
+}
+
 export function buildFileView(
   cfg: Config,
   rawPath: string,
@@ -505,8 +531,9 @@ export function buildFileView(
   const lang = extToLang(rawPath);
   const shownBytes = chunk.rows.reduce((s, r) => s + r.t.length + 1, 0);
   const fullText = chunk.rows.map((r) => r.t).join("\n");
+  const dir = dirname(rawPath);
   const body = mdRender
-    ? `<div class="md-render">${renderMarkdown(fullText, "")}</div>`
+    ? `<div class="md-render">${renderMarkdown(rewriteRelativeMdRefs(fullText, dir), dir)}</div>`
     : lang && shownBytes <= 100000
       ? renderHighlighted(chunk, lang)
       : `<pre><code>${chunk.rows.map((r) => lineRow(r.t, r.n)).join("")}</code></pre>`;