From 5f8704e635df216956870cbf6039c5a036301314 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Tue, 27 Apr 2021 13:08:22 +0200
Subject: [PATCH 1/2] Introduce class
 `Icinga\Web\Helper\Markdown\LinkTransformer`

---
 .../Web/Helper/Markdown/LinkTransformer.php   | 85 +++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 library/Icinga/Web/Helper/Markdown/LinkTransformer.php

diff --git a/library/Icinga/Web/Helper/Markdown/LinkTransformer.php b/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
new file mode 100644
index 000000000..47873d259
--- /dev/null
+++ b/library/Icinga/Web/Helper/Markdown/LinkTransformer.php
@@ -0,0 +1,85 @@
+<?php
+/* Icinga Web 2 | (c) 2021 Icinga GmbH | GPLv2+ */
+
+namespace Icinga\Web\Helper\Markdown;
+
+use HTMLPurifier_AttrTransform;
+use HTMLPurifier_Config;
+use ipl\Stdlib\Str;
+use ipl\Web\Url;
+
+class LinkTransformer extends HTMLPurifier_AttrTransform
+{
+    /**
+     * Link targets with such a file extension are not loaded by an iFrame
+     *
+     * @var string[]
+     */
+    public static $NON_IFRAME_FILES = [
+        'html',
+        'htm',
+        'php',
+        'svg',
+        'aspx',
+        'cshtml',
+        'vbhtml'
+    ];
+
+    /**
+     * Link targets that are considered to have a thumbnail
+     *
+     * @var string[]
+     */
+    public static $IMAGE_FILES = [
+        'jpg',
+        'jpeg',
+        'png',
+        'bmp',
+        'gif',
+        'heif',
+        'heic',
+        'webp'
+    ];
+
+    public function transform($attr, $config, $context)
+    {
+        if (! isset($attr['href'])) {
+            return $attr;
+        }
+
+        $url = Url::fromPath($attr['href']);
+
+        list($_, $ext) = Str::symmetricSplit($url->getPath(), '.', 2);
+
+        $hasThumbnail = $ext !== null && in_array($ext, static::$IMAGE_FILES, true);
+        $useIframe = $ext !== null && ! in_array($ext, static::$NON_IFRAME_FILES, true);
+
+        if ($hasThumbnail) {
+            // I would have liked to not only base this off of the extension, but also by
+            // whether there is an actual img tag inside the anchor. Seems not possible :(
+            $attr['class'] = 'with-thumbnail';
+        }
+
+        if ((! isset($attr['target']) || ! in_array($attr['target'], ['_blank', '_self']))
+            && ($useIframe || $url->isExternal())
+        ) {
+            $attr['href'] = Url::fromPath('iframe', ['url' => $url])->getAbsoluteUrl();
+        }
+
+        return $attr;
+    }
+
+    public static function attachTo(HTMLPurifier_Config $config)
+    {
+        $module = $config->getHTMLDefinition(true)
+            ->getAnonymousModule();
+
+        if (isset($module->info['a'])) {
+            $a = $module->info['a'];
+        } else {
+            $a = $module->addBlankElement('a');
+        }
+
+        $a->attr_transform_post[] = new self();
+    }
+}

From 197f42557a657710a0c69f47b9542081c39d2340 Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@icinga.com>
Date: Tue, 27 Apr 2021 13:10:49 +0200
Subject: [PATCH 2/2] Markdown: Allow to pass purifier config and provide a
 default

---
 library/Icinga/Web/Helper/Markdown.php | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/library/Icinga/Web/Helper/Markdown.php b/library/Icinga/Web/Helper/Markdown.php
index d123341d2..e6509d054 100644
--- a/library/Icinga/Web/Helper/Markdown.php
+++ b/library/Icinga/Web/Helper/Markdown.php
@@ -3,20 +3,36 @@
 
 namespace Icinga\Web\Helper;
 
+use Icinga\Web\Helper\Markdown\LinkTransformer;
 use Parsedown;
 
 class Markdown
 {
-    public static function line($content)
+    public static function line($content, $config = null)
     {
         require_once 'Parsedown/Parsedown.php';
 
-        return HtmlPurifier::process(Parsedown::instance()->line($content));
+        if ($config === null) {
+            $config = function (\HTMLPurifier_Config $config) {
+                $config->set('HTML.Parent', 'span'); // Only allow inline elements
+
+                LinkTransformer::attachTo($config);
+            };
+        }
+
+        return HtmlPurifier::process(Parsedown::instance()->line($content), $config);
     }
 
-    public static function text($content)
+    public static function text($content, $config = null)
     {
         require_once 'Parsedown/Parsedown.php';
-        return HtmlPurifier::process(Parsedown::instance()->text($content));
+
+        if ($config === null) {
+            $config = function (\HTMLPurifier_Config $config) {
+                LinkTransformer::attachTo($config);
+            };
+        }
+
+        return HtmlPurifier::process(Parsedown::instance()->text($content), $config);
     }
 }