fix: allow magnet protocol in href (#1193)

* fix: allow magnet protocol in href

* chore: update

* chore: add ed2k

package.json

@@ -75,6 +75,7 @@
     "clsx": "2.0.0",
     "crossbell": "1.10.1",
     "dayjs": "1.11.10",
+    "deepmerge": "^4.3.1",
     "dotenv": "16.3.1",
     "emoji-mart": "5.5.2",
     "fast-average-color": "9.4.0",

pnpm-lock.yaml

@@ -140,6 +140,9 @@ dependencies:
   dayjs:
     specifier: 1.11.10
     version: 1.11.10
+  deepmerge:
+    specifier: ^4.3.1
+    version: 4.3.1
   dotenv:
     specifier: 16.3.1
     version: 16.3.1
@@ -6430,6 +6433,11 @@ packages:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
     dev: true
 
+  /deepmerge@4.3.1:
+    resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
+    engines: {node: '>=0.10.0'}
+    dev: false
+
   /define-data-property@1.1.0:
     resolution: {integrity: sha512-UzGwzcjyv3OtAvolTj1GoyNYzfFR+iqbGjcnBEENZVCpM4/Ng1yhGNvS3lR/xDS74Tb2wGG9WzNSNIOS9UVb2g==}
     engines: {node: '>= 0.4'}

src/markdown/sanitize-schema.ts

@@ -1,9 +1,8 @@
+import deepmerge from "deepmerge"
 import { defaultSchema } from "rehype-sanitize"
 
-const scheme = {
-  ...defaultSchema,
+const scheme = deepmerge(defaultSchema, {
   tagNames: [
-    ...(defaultSchema.tagNames || []),
     "video",
     "iframe",
     "style",
@@ -18,8 +17,7 @@ const scheme = {
     ...["svg", "path", "circle"],
   ],
   attributes: {
-    ...defaultSchema.attributes,
-    "*": [...(defaultSchema.attributes?.["*"] || []), "className", "style"],
+    "*": ["className", "style"],
     video: ["src", "controls", "loop", "muted", "autoPlay", "playsInline"],
     audio: [
       "src",
@@ -48,6 +46,9 @@ const scheme = {
     path: ["d", "fill"],
     circle: ["cx", "cy", "r", "fill"],
   },
-}
+  protocols: {
+    href: ["magnet", "ed2k"],
+  },
+})
 
 export default scheme