markdown

func Escape ¶ added in v0.38.2

func Escape(input string) string

Escape returns input with its markdown syntax neutralised, so that it renders as the same literal text when placed inline in a markdown string, e.g. a user name inside "**%s**". It targets CommonMark/GFM as rendered by the frontend (marked), which is what displays in-app notification titles. This package's own renderer honours fewer backslash escapes, so don't use it for content rendered by Full or PlainText.

Every ASCII punctuation character is backslash-escaped, which CommonMark and GFM always render as the literal character. This covers emphasis, links, images, code spans, strikethrough, tables, entities ("&") and Fider mentions ("@[...]"), and also stops GFM from auto-linking bare URLs, "www." hosts and email addresses, because "://", "www." and "@" no longer appear contiguously.

"<" is the exception: the frontend entity-encodes "<" before parsing, so inline HTML and "<...>" autolinks are already shown as plain text, and a "\<" would be displayed as "&lt;" rather than "<".

Line breaks are replaced with spaces so the value cannot start a block element such as a heading, list or code block.

func Full ¶ added in v0.17.0

func Full(ctx context.Context, input string, handleImages bool) template.HTML

Full turns a markdown into HTML using all rules.

The context carries the tenant, whose AllowedSchemes setting extends the set of link destinations that may be rendered. A context without a tenant falls back to the baseline schemes, so forgetting to pass one fails closed.

func PlainText ¶ added in v0.13.0

func PlainText(input string) string

PlainText parses given markdown input and return only the text.

The result is unescaped plain text (e.g. "Tom & Jerry", not "Tom &amp; Jerry"), so callers must escape it for wherever it is written to, as html/template does. It is not HTML-safe and must never be wrapped in template.HTML.

Unlike Full, this needs no destination gating or scheme allow list: strictPolicy strips every tag and attribute, so neither an unsafe link destination nor markup forged by the renderer survives.