render html/markdown for new comment notification email

[kimsible]

Fix #3254

[rigelk]

hi @kimsible,

In its current state, this PR is using marked while we use markdown-it for the client render, c.f. https://github.com/Chocobozzz/PeerTube/blob/develop/client/src/app/core/renderer/markdown.service.ts. Could you align with our client service and make use of markdown-it in the server too?

As for the way you render HTML, please note we make use of sanitize-html to provide security as per scenario 2 of https://github.com/markdown-it/markdown-it/blob/master/docs/security.md. Could you align in that matter too?

[kimsible]

Hi @rigelk,

In its current state, this PR is using marked while we use markdown-it for the client render, c.f. https://github.com/Chocobozzz/PeerTube/blob/develop/client/src/app/core/renderer/markdown.service.ts. Could you align with our client service and make use of markdown-it in the server too?

I hesitated because marked-man et marked are already used by the CLI. But you're right ! it's better to use the same libs in the app server - client.

As for the way you render HTML, please note we make use of sanitize-html to provide security as per scenario 2 of https://github.com/markdown-it/markdown-it/blob/master/docs/security.md. Could you align in that matter too?

Thanks I forgot that point !

[kimsible]

@rigelk I've checked the code and I have 2 notices :

• On client side, only markdown emphasis (bold and italic) and lists are not converted to HTML to the database, everything else is HTML, so marked or markdown-it are enough for that, marked is lighter and already a server-side dependency, maybe it is the right choice ? ;
• On client side, we also sanitize the html, so the text of the comment in the database is already sanitized, do we really need to sanitize it again even if it's come from the database ?

[rigelk]

@kimsible please stick with markdown-it. marked is lighter but that doesn't matter when it comes to server-side dependencies, and I prefer consistency with the client part. I don't know why we use marked but that isn't right.

On client side, we also sanitize the html, so the text of the comment in the database is already sanitized, do we really need to sanitize it again even if it's come from the database ?

We sanitize the display, not the storage. Anyway, applying the sanitization is not a costly extra step 😉

[rigelk]

@kimsible thanks a bunch :)

[kimsible]

@rigelk thanks for your help !