diff --git a/src/vs/base/browser/markdownRenderer.ts b/src/vs/base/browser/markdownRenderer.ts index fe822fe1a61c1..62b1a0ead0ec3 100644 --- a/src/vs/base/browser/markdownRenderer.ts +++ b/src/vs/base/browser/markdownRenderer.ts @@ -9,6 +9,7 @@ import { DomEmitter } from 'vs/base/browser/event'; import { createElement, FormattedTextRenderOptions } from 'vs/base/browser/formattedTextRenderer'; import { StandardKeyboardEvent } from 'vs/base/browser/keyboardEvent'; import { StandardMouseEvent } from 'vs/base/browser/mouseEvent'; +import { createTrustedTypesPolicy } from 'vs/base/browser/trustedTypes'; import { renderLabelWithIcons } from 'vs/base/browser/ui/iconLabel/iconLabels'; import { onUnexpectedError } from 'vs/base/common/errors'; import { Event } from 'vs/base/common/event'; @@ -26,6 +27,8 @@ import { dirname, resolvePath } from 'vs/base/common/resources'; import { escape } from 'vs/base/common/strings'; import { URI } from 'vs/base/common/uri'; +const ttPolicy = createTrustedTypesPolicy('markdownRenderer', { createHTML: value => value }); + export interface MarkedOptions extends marked.MarkedOptions { baseUrl?: never; } @@ -306,7 +309,9 @@ export function renderMarkdown(markdown: IMarkdownString, options: MarkdownRende } }); - element.innerHTML = sanitizeRenderedMarkdown(markdown, markdownHtmlDoc.body.innerHTML) as unknown as string; + const html = markdownHtmlDoc.body.innerHTML; + const trustedhtml = ttPolicy ? ttPolicy.createHTML(html) : html; + element.innerHTML = trustedhtml as string; if (codeBlocks.length > 0) { Promise.all(codeBlocks).then((tuples) => { diff --git a/src/vs/base/test/browser/markdownRenderer.test.ts b/src/vs/base/test/browser/markdownRenderer.test.ts index 289b3974df837..4ebba81a9f9ab 100644 --- a/src/vs/base/test/browser/markdownRenderer.test.ts +++ b/src/vs/base/test/browser/markdownRenderer.test.ts @@ -166,7 +166,7 @@ suite('MarkdownRenderer', () => { mds.appendMarkdown(`[$(zap)-link](#link)`); const result: HTMLElement = store.add(renderMarkdown(mds)).element; - assert.strictEqual(result.innerHTML, `

-link

`); + assert.strictEqual(result.innerHTML, `

-link

`); }); test('render icon in table', () => { @@ -186,7 +186,7 @@ suite('MarkdownRenderer', () => { --link +-link `); @@ -253,7 +253,7 @@ suite('MarkdownRenderer', () => { }); const result: HTMLElement = store.add(renderMarkdown(md)).element; - assert.strictEqual(result.innerHTML, `

command1 command2

`); + assert.strictEqual(result.innerHTML, `

command1 command2

`); }); suite('PlaintextMarkdownRender', () => {