Package org.apache.juneau.console.views.markdown

Class CommonmarkMarkdownRenderer

java.lang.Object

org.apache.juneau.console.views.markdown.CommonmarkMarkdownRenderer

All Implemented Interfaces:

MarkdownRenderer

public class CommonmarkMarkdownRenderer
extends Object
implements MarkdownRenderer

The default MarkdownRenderer implementation: a thin wrapper around commonmark-java with the GFM tables extension enabled, HTML-escaped raw markup, and URL allowlisting on <a href> / <img src>.

The GFM tables extension is on by default because real-world documents (runbooks, onboarding guides, skills) routinely use pipe tables, and core CommonMark renders them as paragraphs of literal pipes.

Raw HTML in the markdown source is escaped (escapeHtml(true)), so a <script> or <img onerror> in a SKILL.md becomes visible text, not an element. Link and image URLs are restricted to http/https/mailto, fragments, and scheme-less relative paths; javascript:, data:, and vbscript: are stripped.

commonmark-java's Parser and HtmlRenderer are immutable and thread-safe once built, so a single instance of this class is safe to share across threads and reuse for every render.

See Also:

• MarkdownRenderer
• GFM tables extension

Since:

10.0.0

Constructor Summary

Constructors

Constructor	Description
CommonmarkMarkdownRenderer()	Constructor.

Method Summary

Modifier and Type	Method	Description
static boolean	isSafeUrl(String url)	Whether url is safe to emit as an href or src: http/https/ mailto, a fragment, a same-origin path, or a scheme-less relative URL.
String	toHtml(String markdown)	Renders the specified markdown source to an HTML fragment.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CommonmarkMarkdownRenderer

public CommonmarkMarkdownRenderer()

Constructor.

Builds a parser/renderer pair with the GFM tables extension enabled, raw HTML escaped, and unsafe URLs stripped.

Method Details

toHtml

public String toHtml(String markdown)

Description copied from interface: MarkdownRenderer

Renders the specified markdown source to an HTML fragment.

Specified by:

toHtml in interface MarkdownRenderer

Parameters:

markdown - The markdown source. Must not be null (an empty string renders to an empty fragment).

Returns:

The rendered HTML fragment.

isSafeUrl

public static boolean isSafeUrl(String url)

Whether url is safe to emit as an href or src: http/https/ mailto, a fragment, a same-origin path, or a scheme-less relative URL.

Parameters:

url - The candidate URL. May be null.

Returns:

true if the URL may be copied onto an element.