Skip to content

MDViewer 1.2.0

Choose a tag to compare

View all tags
@devicemanager devicemanager released this 16 Jul 20:55
· 10 commits to main since this release
v1.2.0
8e66975

MDViewer 1.2.0

A security-hardening release. MDViewer now runs inside the macOS App Sandbox and gives you explicit control over remote content, alongside output sanitization, a strict Content-Security-Policy, and refreshed rendering libraries.

App Sandbox

  • Runs sandboxed (com.apple.security.app-sandbox), limiting filesystem/network reach.
  • File access via security-scoped bookmarks; the last-opened document reliably reopens across launches.
  • On-demand folder access: documents referencing local images prompt to grant access to their folder (remembered per folder) — relative images render without exposing your whole disk.
  • Remote images load only when allowed (network-client entitlement).

Remote-content controls (Privacy)

  • New Privacy preference: remote http/https images gated by policy — Ask (per document), Always, or Never.
  • Quick Look always blocks remote content.

Content-injection hardening

  • Rendered Markdown sanitized with DOMPurify before insertion.
  • Strict CSP enforced via response header; renderer served through a custom local scheme (no file:// origin).
  • Clicked links restricted to http/https/mailto and local Markdown.

Dependency updates (provenance recorded)

  • marked 12 → 18.0.6, KaTeX 0.16.11 → 0.17.0, Mermaid 10.9.5 → 11.16.0; syntax highlighting rebuilt from official Shiki 4.3.1 (40 languages).

Fixes

  • Fixed a rendering regression that blanked documents containing headings.
  • Quick Look previews render reliably (deterministic snapshot) and block remote content.

Notarized & stapled. Requires macOS 14 or later.

Assets 4
Loading