From 2f3b5d835c26dff33f24ca85ef5d2a7087f84fd4 Mon Sep 17 00:00:00 2001
From: Alex Ross <alros@microsoft.com>
Date: Tue, 19 Dec 2023 10:41:37 +0100
Subject: [PATCH] Render checkboxes in markdown (#200846)

Fixes microsoft/vscode-pull-request-github#5310
---
 src/vs/base/browser/dom.ts              |  1 +
 src/vs/base/browser/markdownRenderer.ts | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/src/vs/base/browser/dom.ts b/src/vs/base/browser/dom.ts
index c29ece9d7b5..5379bd3814c 100644
--- a/src/vs/base/browser/dom.ts
+++ b/src/vs/base/browser/dom.ts
@@ -1817,6 +1817,7 @@ export const basicMarkupHtmlTags = Object.freeze([
 	'hr',
 	'i',
 	'img',
+	'input',
 	'ins',
 	'kbd',
 	'label',
diff --git a/src/vs/base/browser/markdownRenderer.ts b/src/vs/base/browser/markdownRenderer.ts
index a8ced34246d..fa4352fd344 100644
--- a/src/vs/base/browser/markdownRenderer.ts
+++ b/src/vs/base/browser/markdownRenderer.ts
@@ -388,9 +388,26 @@ function sanitizeRenderedMarkdown(
 			}
 			e.keepAttr = false;
 			return;
+		} else if (element.tagName === 'INPUT' && element.attributes.getNamedItem('type')?.value === 'checkbox') {
+			if ((e.attrName === 'type' && e.attrValue === 'checkbox') || e.attrName === 'disabled' || e.attrName === 'checked') {
+				e.keepAttr = true;
+				return;
+			}
+			e.keepAttr = false;
 		}
 	});
 
+	dompurify.addHook('uponSanitizeElement', (element, e) => {
+		if (e.tagName === 'input') {
+			if (element.attributes.getNamedItem('type')?.value === 'checkbox') {
+				element.setAttribute('disabled', '');
+			} else {
+				element.parentElement?.removeChild(element);
+			}
+		}
+	});
+
+
 	const hook = DOM.hookDomPurifyHrefAndSrcSanitizer(allowedSchemes);
 
 	try {
@@ -405,10 +422,12 @@ export const allowedMarkdownAttr = [
 	'align',
 	'autoplay',
 	'alt',
+	'checked',
 	'class',
 	'controls',
 	'data-code',
 	'data-href',
+	'disabled',
 	'draggable',
 	'height',
 	'href',
@@ -420,6 +439,7 @@ export const allowedMarkdownAttr = [
 	'style',
 	'target',
 	'title',
+	'type',
 	'width',
 	'start',
 ];