Open
Description
Bug Report
<script>// my script</script>
in md file from basePath
is not executed.
Steps to reproduce
- Provide the
basePath
as a full url with a domain different from the domain ofindex.html
. - open url of
index.html
with your browser. - When you fetch the md files from
basePath
, you can check that the script in the md file cannot be executed.
What is current behaviour
In this case, the value of isRemoteUrl
is determined to be true, so the <script> code is sanitized by the code below.
docsify/src/core/render/index.js
Lines 332 to 334 in c3cdadc
What is the expected behaviour
basePath
is a value that can be entered only with the authority of the document site administrator, and the basePath server can also be considered owned by the administrator, so the isRemoteUrl
value should be false
.
Other relevant information
-
Bug does still occur when all/other plugins are disabled?
-
Your OS: macOS 11
-
Node.js version:
-
npm/yarn version:
-
Browser version:
-
Docsify version: 4.12.1
-
Docsify plugins:
Metadata
Metadata
Assignees
Labels
No labels