fix(ui): harden markdown rendering

Cargo.toml

@@ -43,3 +43,14 @@ strip = true
 
 [profile.release.package."*"]
 opt-level = 'z'
+
+# markdown 1.0.0 (the latest release) plus parser fixes that upstream has not
+# released (wooorm/markdown-rs GH-22, GH-23, GH-31, GH-79, #206, #263, #267, and
+# one more), and an indexed edit map that makes parsing a long document linear
+# rather than quadratic in its length. The same branch River pins, one commit
+# later. Drop this only once a release contains all of them;
+# ui/src/components/markdown_render.rs `malformed_markdown_renders_without_panicking`
+# fails if a parser fix is missing.
+# https://github.com/freenet/markdown-rs/commits/freenet/panic-fixes
+[patch.crates-io]
+markdown = { git = "https://github.com/freenet/markdown-rs", rev = "c0646ed72010008a3ea92bf52be43082a09bdd12" }

ui/src/components.rs

@@ -1,6 +1,7 @@
 mod add_site_dialog;
 mod editor;
 pub(crate) mod export_key;
+mod markdown_render;
 mod page_view;
 mod pages_sidebar;
 mod sites_sidebar;

ui/src/components/editor.rs

@@ -132,18 +132,16 @@ pub fn Editor() -> Element {
 
     let title = state::EDITOR_TITLE.read().clone();
     let content = state::EDITOR_CONTENT.read().clone();
-    let preview_html = markdown::to_html_with_options(&content, &markdown::Options::gfm())
-        .unwrap_or_else(|_| markdown::to_html(&content));
-    // Inject heading ids so in-page anchor links (`[Link](#heading)`) work
-    // in the live preview as well as in the rendered page view, and
-    // beautify any Freenet URLs the user has typed. Honor the same
-    // gateway-detection flag the rendered page view uses — passing
-    // `true` unconditionally would show a same-origin `/v1/contract/
-    // web/...` path in `dx serve` previews where there's no gateway
-    // behind Delta to resolve it.
-    let preview_html = super::page_view::inject_heading_ids(&preview_html);
-    let preview_html = super::page_view::finalize_anchors(
-        &preview_html,
+    // Render through the same bounded path as the page view, which also
+    // injects heading ids so in-page anchor links (`[Link](#heading)`) work
+    // in the live preview, and beautifies any Freenet URLs the user has
+    // typed. Honor the same gateway-detection flag the rendered page view
+    // uses — passing `true` unconditionally would show a same-origin
+    // `/v1/contract/web/...` path in `dx serve` previews where there's no
+    // gateway behind Delta to resolve it.
+    let preview_html = super::markdown_render::render_page_html(
+        &content,
+        &content,
         super::page_view::behind_gateway(),
         super::page_view::own_contract_id().as_deref(),
     );