elemes

Commit Graph

Author	SHA1	Message	Date
a2nr	2a09ee77ab	feat(embed): add raw HTML embed fence with bleach sanitization - Add embed markdown fence: user pastes raw embed HTML code (from Canva/YouTube/Google Docs Share→Embed) into lesson markdown and slide content. Backend sanitizes via bleach (whitelist tags/attrs/styles) + checks iframe src against domain blacklist (SSRF prevention). Frontend renders iframe directly — no lazy action needed. - Backend: _process_embed_embeds + _sanitize_embed_html in lesson_service.py, applied to lesson_content, exercise, lesson_info, and slide loop. Graceful fallback if tinycss2 missing (CSS unsanitized but tags/attrs still stripped). - Tests: 9 pytest cases (Canva/YouTube HTML, script stripping, onclick stripping, blocked domain, non-https iframe, empty, unchanged, dangerous style). - Frontend: remove renderEmbedEmbeds.ts + wire-up + .generic-embed CSS (URL-only approach from earlier iteration, superseded). Keep .embed-error CSS for error messages. - Example: update test_slides.md with raw HTML Canva embed (slide) + YouTube embed (body). - Deps: bleach>=6.0.0, tinycss2>=1.2.0 in requirements.txt. - Docs: consolidate 4 plan files into docs/06-embed-content.md.	2026-07-19 15:39:38 +07:00
a2nr	d6bb2073ac	feat: add markdown link support for lesson prerequisites - Update lesson_service.py to parse markdown link format [title](path) - Convert all lesson files to use markdown link format for prerequisites - Backend now extracts slug directly from link path - Supports both plain text and markdown link formats	2026-07-18 07:31:10 +07:00
a2nr	bc49877123	feat: update to support folder inside content folder to easy to manage	2026-05-14 19:45:10 +07:00

Author

SHA1

Message

Date

a2nr

2a09ee77ab

feat(embed): add raw HTML embed fence with bleach sanitization

- Add embed markdown fence: user pastes raw embed HTML code
  (from Canva/YouTube/Google Docs Share→Embed) into lesson markdown
  and slide content. Backend sanitizes via bleach (whitelist
  tags/attrs/styles) + checks iframe src against domain blacklist
  (SSRF prevention). Frontend renders iframe directly — no lazy
  action needed.
- Backend: _process_embed_embeds + _sanitize_embed_html in
  lesson_service.py, applied to lesson_content, exercise,
  lesson_info, and slide loop. Graceful fallback if tinycss2
  missing (CSS unsanitized but tags/attrs still stripped).
- Tests: 9 pytest cases (Canva/YouTube HTML, script stripping,
  onclick stripping, blocked domain, non-https iframe, empty,
  unchanged, dangerous style).
- Frontend: remove renderEmbedEmbeds.ts + wire-up + .generic-embed
  CSS (URL-only approach from earlier iteration, superseded).
  Keep .embed-error CSS for error messages.
- Example: update test_slides.md with raw HTML Canva embed (slide)
  + YouTube embed (body).
- Deps: bleach>=6.0.0, tinycss2>=1.2.0 in requirements.txt.
- Docs: consolidate 4 plan files into docs/06-embed-content.md.

2026-07-19 15:39:38 +07:00

a2nr

d6bb2073ac

feat: add markdown link support for lesson prerequisites

- Update lesson_service.py to parse markdown link format [title](path)
- Convert all lesson files to use markdown link format for prerequisites
- Backend now extracts slug directly from link path
- Supports both plain text and markdown link formats

2026-07-18 07:31:10 +07:00

a2nr

bc49877123

feat: update to support folder inside content folder to easy to manage

2026-05-14 19:45:10 +07:00

3 Commits