Preserve safe data image sources

Author: danieliser

src/render/mdx.ts

@@ -38,6 +38,10 @@ const sanitizeSchema: Schema = {
     h5: [...(defaultSchema.attributes?.h5 ?? []), "id"],
     h6: [...(defaultSchema.attributes?.h6 ?? []), "id"],
     code: [...(defaultSchema.attributes?.code ?? []), ["className", /^language-[\w-]+$/]]
+  },
+  protocols: {
+    ...defaultSchema.protocols,
+    src: [...(defaultSchema.protocols?.src ?? []), "data"]
   }
 };
 

test/mdx-images.test.ts

@@ -0,0 +1,13 @@
+import { renderMdxToHtml } from "../src/render/mdx.js";
+
+describe("MDX image rendering", () => {
+  it("keeps safe data image sources", async () => {
+    const html = await renderMdxToHtml(
+      "![tiny red dot](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJ)",
+      "Image Test"
+    );
+
+    expect(html).toContain('src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJ"');
+    expect(html).toContain('alt="tiny red dot"');
+  });
+});