feat(markdown): Render lesson Markdown to sanitized, cached HTML#90
Merged
Conversation
This was referenced Jul 12, 2026
Merged
ebouchut
changed the title
ebouchut
force-pushed
the
feat/course-lesson-domain
branch
from
e0c5952 to
4ed7c36
Compare
ebouchut
force-pushed
the
feat/markdown-rendering
branch
from
567d675 to
eebd3c6
Compare
ebouchut
added
documentation
ebouchut
force-pushed
the
feat/course-lesson-domain
branch
from
4ed7c36 to
11e78cb
Compare
ebouchut
force-pushed
the
feat/markdown-rendering
branch
from
eebd3c6 to
bb1c2e3
Compare
ebouchut
force-pushed
the
feat/course-lesson-domain
branch
from
11e78cb to
54630d2
Compare
ebouchut
force-pushed
the
feat/markdown-rendering
branch
from
bb1c2e3 to
4cd8d21
Compare
Record the lesson Markdown rendering decision: commonmark-java (the CommonMark reference implementation) converts, jsoup's allowlist sanitizes the output because instructor content is untrusted input and raw HTML passes through the renderer, and Spring Cache over Caffeine memoizes the result keyed by the SHA-256 of the source (content addressed, so entries cannot go stale). flexmark and a server-side JavaScript renderer were considered and rejected as disproportionate for v1.
Add commonmark (0.24.0), jsoup (1.21.1), spring-boot-starter-cache, and the Boot-managed Caffeine, per ADR-0013. MarkdownRenderer parses and renders the Markdown, then cleans the HTML through Safelist.relaxed() plus the class attribute on code (language hints for a future syntax highlighter): scripts, event handlers, and javascript: URLs do not survive, whatever the lesson contains. CacheConfig enables caching with a single renderedMarkdown cache capped at 1000 entries; entries are keyed by the SHA-256 of the source, so an edited lesson is a new key and no invalidation logic exists. Both glossaries define Markdown, CommonMark, jsoup, and Caffeine, and the tech stack gains a Content rendering section. Fixes #35 Fixes #36 Fixes #37 Fixes #38
Boot a minimal context (CacheConfig plus the renderer, no database) so Cacheable runs through the real proxy: common constructs render to HTML with the language hint kept, hostile Markdown loses its script, event handler, and javascript: URL, the second render of identical content returns the cached instance itself, and blank content renders empty.
ebouchut
force-pushed
the
feat/markdown-rendering
branch
from
4cd8d21 to
031c3c9
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## dev #90 +/- ##
============================================
- Coverage 81.49% 81.30% -0.20%
- Complexity 55 62 +7
============================================
Files 21 23 +2
Lines 227 246 +19
Branches 12 13 +1
============================================
+ Hits 185 200 +15
- Misses 30 32 +2
- Partials 12 14 +2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is part 5 of 5 in a stack made with GitButler: