Rocket.Chat/app/markdown/lib/parser/marked/marked.js

import { Random } from 'meteor/random';
import _ from 'underscore';
import _marked from 'marked';
import dompurify from 'dompurify';

import hljs from '../../hljs';
import { escapeHTML } from '../../../../../lib/escapeHTML';
import { unescapeHTML } from '../../../../../lib/unescapeHTML';

const renderer = new _marked.Renderer();

let msg = null;

renderer.code = function(code, lang, escaped) {
	if (this.options.highlight) {
		const out = this.options.highlight(code, lang);
		if (out != null && out !== code) {
			escaped = true;
			code = out;
		}
	}

	let text = null;

	if (!lang) {
		text = `<pre><code class="code-colors hljs">${ escaped ? code : escapeHTML(code) }</code></pre>`;
	} else {
		text = `<pre><code class="code-colors hljs ${ escape(lang, true) }">${ escaped ? code : escapeHTML(code) }</code></pre>`;
	}

	if (_.isString(msg)) {
		return text;
	}

	const token = `=!=${ Random.id() }=!=`;
	msg.tokens.push({
		highlight: true,
		token,
		text,
	});

	return token;
};

renderer.codespan = function(text) {
	text = `<code class="code-colors inline">${ text }</code>`;
	if (_.isString(msg)) {
		return text;
	}

	const token = `=!=${ Random.id() }=!=`;
	msg.tokens.push({
		token,
		text,
	});

	return token;
};

renderer.blockquote = function(quote) {
	return `<blockquote class="background-transparent-darker-before">${ quote }</blockquote>`;
};

const linkRenderer = renderer.link;
renderer.link = function(href, title, text) {
	const html = linkRenderer.call(renderer, href, title, text);
	return html.replace(/^<a /, '<a target="_blank" rel="nofollow noopener noreferrer" ');
};

const highlight = function(code, lang) {
	if (!lang) {
		return code;
	}
	try {
		return hljs.highlight(lang, code).value;
	} catch (e) {
		// Unknown language
		return code;
	}
};

export const marked = (message, {
	marked: {
		gfm,
		tables,
		breaks,
		pedantic,
		smartLists,
		smartypants,
	} = {},
}) => {
	msg = message;

	if (!message.tokens) {
		message.tokens = [];
	}

	message.html = _marked(unescapeHTML(message.html), {
		gfm,
		tables,
		breaks,
		pedantic,
		smartLists,
		smartypants,
		renderer,
		sanitize: true,
		highlight,
	});

	message.html = dompurify.sanitize(message.html);

	return message;
};