Add full GFM support, update assets/screenshot.png

Author: python-processing-unit

assets/screenshot.png

@@ -15,6 +15,7 @@
     QSize,
     Qt,
     QTimer,
+    QUrl,
     Signal,
 )
 from PySide6.QtGui import (
@@ -24,6 +25,7 @@
     QEnterEvent,
     QFont,
     QIcon,
+    QImage,
     QKeyEvent,
     QKeySequence,
     QMouseEvent,
@@ -37,6 +39,7 @@
     QTextCursor,
     QTextDocument,
     QTextFormat,
+    QTextImageFormat,
 )
 from PySide6.QtWidgets import (
     QApplication,
@@ -573,6 +576,87 @@ def __init__(self, tab: EditorTab) -> None:
             | Qt.TextInteractionFlag.LinksAccessibleByKeyboard
         )
 
+    def set_preview_html(self, html: str, *, base_dir: Path | None) -> None:
+        """Load *html* with a file base URL and scale images to the viewport.
+
+        QTextBrowser ignores CSS ``max-width`` / percentage ``width`` on
+        ``<img>``, so large screenshots stay at intrinsic size and look
+        cropped/off-center. After parse, clamp every image to the pane width.
+        """
+        root = (base_dir if base_dir is not None else Path.cwd()).resolve()
+        base = QUrl.fromLocalFile(str(root) + "/")
+        self.document().setBaseUrl(base)
+        self.setHtml(html)
+        self.fit_images()
+
+    def fit_images(self) -> None:
+        """Clamp embedded images to the viewport width (keep aspect ratio)."""
+        doc = self.document()
+        max_w = max(float(self.viewport().width() - 8), 32.0)
+        # Skip no-op format writes when size already matches within half a pixel.
+        eps = 0.5
+        block = doc.begin()
+        while block.isValid():
+            it = block.begin()
+            while not it.atEnd():
+                frag = it.fragment()
+                if frag.isValid() and frag.charFormat().isImageFormat():
+                    img_fmt = frag.charFormat().toImageFormat()
+                    image = self._image_for_format(img_fmt)
+                    if image is not None and not image.isNull() and image.width() > 0:
+                        iw = float(image.width())
+                        ih = float(image.height())
+                        # Honor explicit pixel widths when they already fit.
+                        cur_w = img_fmt.width()
+                        if cur_w > 0 and cur_w <= max_w:
+                            new_w = cur_w
+                        else:
+                            new_w = min(iw, max_w)
+                        new_h = ih * (new_w / iw)
+                        if (
+                            abs(img_fmt.width() - new_w) >= eps
+                            or abs(img_fmt.height() - new_h) >= eps
+                        ):
+                            img_fmt.setWidth(new_w)
+                            img_fmt.setHeight(new_h)
+                            cur = QTextCursor(doc)
+                            cur.setPosition(frag.position())
+                            cur.setPosition(
+                                frag.position() + frag.length(),
+                                QTextCursor.MoveMode.KeepAnchor,
+                            )
+                            cur.setCharFormat(img_fmt)
+                it += 1
+            block = block.next()
+
+    def _image_for_format(self, img_fmt: QTextImageFormat) -> QImage | None:
+        """Resolve a ``QTextImageFormat`` to a ``QImage`` via base URL or path.
+
+        Returns:
+            The loaded image, or ``None`` when the resource cannot be resolved.
+        """
+        name = img_fmt.name()
+        url = QUrl(name)
+        if url.isRelative():
+            url = self.document().baseUrl().resolved(url)
+        if url.isLocalFile():
+            image = QImage(url.toLocalFile())
+            if not image.isNull():
+                return image
+        res = self.document().resource(
+            QTextDocument.ResourceType.ImageResource,
+            QUrl(name),
+        )
+        if isinstance(res, QImage):
+            return res
+        return None
+
+    @override
+    def resizeEvent(self, event: QResizeEvent) -> None:
+        """Re-fit images when the preview pane width changes."""
+        super().resizeEvent(event)
+        self.fit_images()
+
     def _source_range_for_preview_selection(self) -> tuple[int, int]:
         """Map the current preview selection (or caret) onto source offsets.
 
@@ -1042,7 +1126,8 @@ def refresh_preview(self, *, follow_source_caret: bool = False) -> None:
         source = self.editor.toPlainText()
         source_pos = self.editor.textCursor().position()
 
-        self.preview.setHtml(to_html(source))
+        base_dir = self.path.parent if self.path is not None else None
+        self.preview.set_preview_html(to_html(source), base_dir=base_dir)
         plain_after = self.preview.toPlainText()
         new_pos = source_pos_to_preview(source, plain_after, source_pos)
 

src/morgul/app.py

@@ -8,16 +8,33 @@
 import re
 
 from markdown_it import MarkdownIt
-from mdit_py_plugins.tasklists import tasklists_plugin
+from mdit_py_plugins.gfm import gfm_plugin
 
-# CommonMark + GFM tables + task lists; raw HTML off for untrusted source.
+# GFM preset: tables, strikethrough, autolinks, task lists, footnotes.
+# HTML enabled so <img>, <br>, <b>, etc. pass through; tagfilter blocks
+# the dangerous tags per GFM spec §6.12.
 # ponytail: single shared parser; rebuild if you ever need per-call options.
-_PARSER = (
-    MarkdownIt("commonmark", {"html": False, "linkify": False})
-    .enable("table")
-    .use(tasklists_plugin)
+_PARSER = MarkdownIt("commonmark", {"html": True, "linkify": False}).use(
+    gfm_plugin,
 )
 
+# GFM "Disallowed Raw HTML" tagfilter (spec §6.12).
+# Escapes the opening `<` of dangerous tags; all other HTML passes through.
+_DISALLOWED_TAGS = re.compile(
+    r"<(/?)(title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)\b",
+    re.IGNORECASE,
+)
+
+
+def _tagfilter(html: str) -> str:
+    """Apply GFM tagfilter: escape disallowed raw HTML tags.
+
+    Returns:
+        HTML with ``<`` replaced by ``&lt;`` for blocked tag names.
+    """
+    return _DISALLOWED_TAGS.sub(r"&lt;\1\2", html)
+
+
 # Loose task syntax people type: ``- [] foo`` (GFM needs a space inside).
 _LOOSE_EMPTY_BOX = re.compile(
     r"^(\s*(?:[-*+]|\d+[.)])\s+)\[\](\s+)",
@@ -80,6 +97,7 @@
 th { background: #2d2d2d; font-weight: 600; }
 tr:nth-child(even) td { background: #252526; }
 hr { border: none; border-top: 1px solid #484848; }
+img { max-width: 100%; height: auto; }
 /* Hide the default bullet; the ☑/☐ glyph is the marker. */
 ul.contains-task-list { list-style: none; padding-left: 0.35em; }
 ul.contains-task-list > li { margin: 0.15em 0; }
@@ -112,7 +130,8 @@ def to_html(source: str) -> str:
     Returns:
         A self-contained HTML page suitable for ``QTextBrowser.setHtml``.
     """
-    body = _qtify_tasklists(_PARSER.render(_normalize_task_markdown(source)))
+    rendered = _PARSER.render(_normalize_task_markdown(source))
+    body = _qtify_tasklists(_tagfilter(rendered))
     return (
         "<!DOCTYPE html><html><head><meta charset='utf-8'>"
         f"<style>{_CSS}</style></head><body>{body}</body></html>"

src/morgul/render.py

@@ -61,6 +61,42 @@ def test_to_html_accepts_loose_empty_task_box() -> None:
     assert 'type="checkbox"' not in html
 
 
+def test_to_html_allows_img_tag() -> None:
+    html = to_html('<img src="pic.png" alt="photo">')
+    assert '<img src="pic.png" alt="photo">' in html
+
+
+def test_to_html_allows_br_and_inline_html() -> None:
+    html = to_html("line<br>break")
+    assert "<br>" in html
+    html = to_html("Hello <b>bold</b> and <i>italic</i>")
+    assert "<b>bold</b>" in html
+    assert "<i>italic</i>" in html
+
+
+def test_to_html_tagfilter_blocks_script() -> None:
+    html = to_html("<script>alert(1)</script>")
+    assert "<script>" not in html
+    assert "</script>" not in html
+    # Only `<` is replaced; `>` passes through.
+    assert "&lt;script>alert(1)&lt;/script>" in html
+
+
+def test_to_html_tagfilter_blocks_style_iframe() -> None:
+    # Check body content only (the document head has its own <style>).
+    body = to_html("<style>body{}</style>").split("<body>")[1].split("</body>")[0]
+    assert "<style>" not in body
+    assert "&lt;style>" in body
+    body = to_html("<iframe src=x></iframe>").split("<body>")[1].split("</body>")[0]
+    assert "<iframe" not in body
+    assert "&lt;iframe" in body
+
+
+def test_to_html_renders_strikethrough() -> None:
+    html = to_html("~~deleted~~")
+    assert "<s>deleted</s>" in html
+
+
 def test_heading_span() -> None:
     spans, fence = spans_in_line("# Title", in_fence=False)
     assert fence is False