T-8H57-obsidian-md-review-bug-triage

State: closed/done · Impact: high · Complexity: medium

Goal

The high-level review of obsidian-md confirmed 15 correctness bugs. Three rollout waves put the renderer in front of content the app did not author (SDLC entity bodies, agent answers, pumice admin bodies). This task triages all 15 and fixes the sanitize and routing class before those viewers ship; the rest are fixed or filed.

Today

Location	Role today
`docs/planning/backlog/B-S2FC-obsidian-md-review-findings.md`	The 15 findings, one paragraph
`packages/ts/obsidian-md/src/sanitize.ts`	`obsidianSchema` allowlist; class names survive into component routing
`packages/ts/obsidian-md/src/vue/render.ts`	Component-override routing by tag, class and `lang:`
`packages/ts/obsidian-md/src/vue/ObsidianMarkdown.ts`	Host options, `resolveLink`, `NoteSource` binding
`packages/ts/obsidian-md/src/vue/components/ObsidianEmbed.ts`	Embed render; drops host options and sanitize schema, swallows events
`packages/ts/obsidian-md/src/vue/components/WikilinkAnchor.ts`	Wikilink anchor; `resolveLink` unbound from class-based sources
`packages/ts/obsidian-md/src/plugins/comments.ts`	`%%` comments; multi-paragraph and unclosed forms leak
`packages/ts/obsidian-md/src/plugins/block-ids.ts`	Block-id stripping deletes mid-line author text
`packages/ts/obsidian-md/src/plugins/shiki.ts`	Highlighting drops block-reference anchors; poisoned highlighter cache
`packages/ts/obsidian-md/src/plugins/wikilinks.ts`	Tokenizes inside markdown links; inline markup in aliases
`packages/ts/obsidian-md/src/plugins/tags.ts`	Tokenizes inside markdown links
`packages/ts/obsidian-md/src/plugins/embeds.ts`	Media embeds render as broken images
`packages/ts/obsidian-md/src/slice.ts`	CRLF and string-domain heading slicing diverge from the parser
`packages/ts/obsidian-md/test/sanitize.test.ts`	Sanitize regression suite
`packages/ts/obsidian-md/test/vue-security.test.ts`	Vue-side security suite
`packages/ts/obsidian-md/test/vue-render.test.ts`	Routing and render suite
`packages/ts/obsidian-md/test/slice.test.ts`	Slicing suite

Proposed

A triage table in the PR lists all 15 findings with a class (routing, sanitize, slice, tokenize, render) and a disposition (fixed here or a backlog id). Fixed here, each with a failing-then-passing test: component routing forgeable from note-authored raw HTML (mermaid, wikilink, callout via class names), %% comments leaking when multi-paragraph or unclosed, embed renders dropping host options and the sanitize schema, escaped syntax wrongly activated, and the unbound resolveLink detaching class-based NoteSources. Findings that are small (under an hour) are fixed too; the rest get one backlog entry each via sdlc backlog create. The CRLF slicing finding is handed to T-0GV4-md-engine-line-endings-corpus.

Approach

Reproduce each finding as a test in the matching test/*.test.ts file; record class and disposition in the triage table.
Routing: in render.ts, route components only from nodes the pipeline produced (a provenance flag from provenance.ts), never from raw HTML class names; strip obsmd-* and routing classes from raw HTML in sanitize.ts.
Sanitize: fix comments.ts for multi-paragraph and unclosed %%; make ObsidianEmbed.ts pass host options and the sanitize schema to the nested render and stop swallowing events; fix escaped-syntax activation in the affected tokenizers.
Binding: bind resolveLink in ObsidianMarkdown.ts so class-based NoteSources keep this.
Fix any remaining finding that is small; file the others with sdlc backlog create, linking B-S2FC-obsidian-md-review-findings.
bun test and tsc --noEmit in packages/ts/obsidian-md; moon run product-workbench:check (notes is the largest consumer); moon run :check :test --affected.

Files to touch

Location	Kind	Change
`packages/ts/obsidian-md/src/sanitize.ts`	modify	Strip routing classes from raw HTML
`packages/ts/obsidian-md/src/vue/render.ts`	modify	Route only pipeline-produced nodes
`packages/ts/obsidian-md/src/vue/ObsidianMarkdown.ts`	modify	Bind `resolveLink`
`packages/ts/obsidian-md/src/vue/components/ObsidianEmbed.ts`	modify	Forward host options and schema; stop swallowing events
`packages/ts/obsidian-md/src/plugins/comments.ts`	modify	Multi-paragraph and unclosed `%%`
`packages/ts/obsidian-md/src/plugins/wikilinks.ts`	modify	Escaped syntax; alias markup if small
`packages/ts/obsidian-md/src/plugins/tags.ts`	modify	Escaped syntax; tokenizing inside links if small
`packages/ts/obsidian-md/test/sanitize.test.ts`	modify	Regression tests
`packages/ts/obsidian-md/test/vue-security.test.ts`	modify	Regression tests
`packages/ts/obsidian-md/test/vue-render.test.ts`	modify	Regression tests
`packages/ts/obsidian-md/test/embeds.test.ts`	modify	Regression tests
`docs/planning/backlog/`	new	One entry per deferred finding

Acceptance criteria

AC-1: The PR body carries a 15-row triage table with class and disposition per finding.
AC-2: A raw-HTML div carrying class="obsmd-mermaid", an a carrying the wikilink class, and a div carrying the callout class in note text do not route to MermaidBlock, WikilinkAnchor or ObsidianCallout (tests in vue-security.test.ts).
AC-3: An unclosed %% and a multi-paragraph %% ... %% render none of their content (tests in sanitize.test.ts or a new comments.test.ts).
AC-4: An embed renders with the host’s components, resolveLink and sanitize schema and click events reach the host (test in embeds.test.ts).
AC-5: A class-based NoteSource whose resolveLink reads this works (test in vue-render.test.ts).
AC-6: bun test and tsc --noEmit pass in packages/ts/obsidian-md.
AC-7: Every finding not fixed here has a backlog file under docs/planning/backlog/ whose body cites B-S2FC-obsidian-md-review-findings; the triage table names each id.

Out of scope

The CRLF slicing fix (T-0GV4-md-engine-line-endings-corpus).
The ./plugins subpath and dependency re-homing (T-Z6X5-obsidian-md-plugins-subpath).
Editor-side (obsidian-editor) issues; this task is renderer-only.

Dependencies

None on other tasks. Gates T-I4V6-sdf-entity-body-viewer, T-FDZ3-agent-chat-markdown-answers and T-ZPKQ-pumice-admin-body-renderer-seam.
D-7VMX-markdown-ecosystem-strategy: one parse per plane; fixes land in the plugins, not in consumers.

Discovery context

Member of milestone M-931L; promoted from backlog item B-S2FC-obsidian-md-review-findings; the untrusted-content gate of D-K3EM-markdown-editor-chrome-and-plugin-environment.

← Back to Tasks