app/src/lib/render/markdown.ts

@@ -1,53 +0,0 @@
-import { Marked } from 'marked';
-import DOMPurify from 'dompurify';
-import hljs from 'highlight.js/lib/core';
-import javascript from 'highlight.js/lib/languages/javascript';
-import bash from 'highlight.js/lib/languages/bash';
-import typescript from 'highlight.js/lib/languages/typescript';
-import json from 'highlight.js/lib/languages/json';
-
-hljs.registerLanguage('javascript', javascript);
-hljs.registerLanguage('js', javascript);
-hljs.registerLanguage('typescript', typescript);
-hljs.registerLanguage('ts', typescript);
-hljs.registerLanguage('bash', bash);
-hljs.registerLanguage('sh', bash);
-hljs.registerLanguage('json', json);
-
-/**
- * Lokaler Marked-Instance, damit die globale `marked`-Singleton nicht
- * mutiert wird — andere Module können `marked` unbeeinflusst weiterverwenden.
- * (Spec §3: lokale Ersetzbarkeit der Engine.)
- */
-const markedInstance = new Marked({
-	breaks: true,
-	gfm: true,
-	renderer: {
-		code({ text, lang }) {
-			const language = lang && hljs.getLanguage(lang) ? lang : undefined;
-			const highlighted = language
-				? hljs.highlight(text, { language }).value
-				: hljs.highlightAuto(text).value;
-			const cls = language ? ` language-${language}` : '';
-			return `<pre><code class="hljs${cls}">${highlighted}</code></pre>`;
-		}
-	}
-});
-
-/**
- * Rendert einen Markdown-String zu sanitized HTML.
- * Einziger Export des Moduls — so bleibt Austausch der Engine lokal.
- *
- * Nur im Browser/jsdom aufrufen: DOMPurify braucht ein DOM. Die SPA
- * hat SSR global ausgeschaltet (`+layout.ts: ssr = false`), Vitest läuft
- * in jsdom — beide Szenarien sind abgedeckt. Ein Aufruf in reiner
- * Node-Umgebung würde hier laut fehlschlagen statt stumm unsicher
- * durchzulaufen.
- */
-export function renderMarkdown(md: string): string {
-	if (typeof window === 'undefined') {
-		throw new Error('renderMarkdown: DOM-Kontext erforderlich (Browser oder jsdom).');
-	}
-	const raw = markedInstance.parse(md, { async: false }) as string;
-	return DOMPurify.sanitize(raw);
-}

app/tests/unit/markdown.test.ts

@@ -1,81 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { renderMarkdown } from '$lib/render/markdown';
-
-describe('renderMarkdown', () => {
-  it('rendert einfachen Markdown-Text zu HTML', () => {
-    const html = renderMarkdown('**bold** and *italic*');
-    expect(html).toContain('<strong>bold</strong>');
-    expect(html).toContain('<em>italic</em>');
-  });
-
-  it('entfernt <script>-Tags (DOMPurify)', () => {
-    const html = renderMarkdown('hello <script>alert("x")</script> world');
-    expect(html).not.toContain('<script>');
-  });
-
-  it('entfernt javascript:-URLs', () => {
-    const html = renderMarkdown('[click](javascript:alert(1))');
-    expect(html).not.toMatch(/javascript:/i);
-  });
-
-  it('rendert Links mit http:// und erhält das href', () => {
-    const html = renderMarkdown('[nostr](https://nostr.com)');
-    expect(html).toContain('href="https://nostr.com"');
-  });
-
-  it('rendert horizontale Linie aus ---', () => {
-    const html = renderMarkdown('oben\n\n---\n\nunten');
-    expect(html).toContain('<hr>');
-  });
-
-  it('rendert fenced code blocks mit hljs-klasse', () => {
-    const html = renderMarkdown('```js\nconst x = 1;\n```');
-    expect(html).toContain('<pre>');
-    expect(html).toContain('<code');
-    expect(html).toContain('class="hljs');
-  });
-
-  it('rendert GFM tables', () => {
-    const md = '| a | b |\n|---|---|\n| 1 | 2 |';
-    const html = renderMarkdown(md);
-    expect(html).toContain('<table');
-    expect(html).toContain('<td>1</td>');
-  });
-
-  it('rendert Bilder', () => {
-    const html = renderMarkdown('![alt](https://example.com/img.png)');
-    expect(html).toContain('<img');
-    expect(html).toContain('src="https://example.com/img.png"');
-  });
-
-  // Erweiterte XSS-Matrix — relevant ab Reply-Komponenten (3rd-party Content).
-  it('entfernt onerror-Attribute auf inline-HTML-img', () => {
-    const html = renderMarkdown('<img src="x" onerror="alert(1)">');
-    expect(html.toLowerCase()).not.toContain('onerror');
-  });
-
-  it('entfernt onclick-Attribute auf inline-HTML', () => {
-    const html = renderMarkdown('<a href="#" onclick="alert(1)">x</a>');
-    expect(html.toLowerCase()).not.toContain('onclick');
-  });
-
-  it('entfernt iframe-Tags', () => {
-    const html = renderMarkdown('<iframe src="https://evil.com"></iframe>');
-    expect(html.toLowerCase()).not.toContain('<iframe');
-  });
-
-  it('entfernt data:text/html-URLs in Links', () => {
-    const html = renderMarkdown('[x](data:text/html,<script>alert(1)</script>)');
-    expect(html.toLowerCase()).not.toMatch(/href="data:text\/html/);
-  });
-
-  it('entfernt vbscript:-URLs', () => {
-    const html = renderMarkdown('<a href="vbscript:msgbox(1)">x</a>');
-    expect(html.toLowerCase()).not.toContain('vbscript:');
-  });
-
-  it('entfernt script-Tag innerhalb svg', () => {
-    const html = renderMarkdown('<svg><script>alert(1)</script></svg>');
-    expect(html.toLowerCase()).not.toContain('<script');
-  });
-});