* Switch to dompurify for sanitizing markdown content
Switches us from using `insane` to instead use `dompurify`, which seems to be better maintained and also has some nice features, such as built-in trusted types support
I've tried to port over our existing sanitizer settings as best as possible, but there's not always a 1:1 mapping between how insane works and how dompurify does. I'd like to get this change in early in the iteration to catch potential regressions
* Remove logging and renaming param
* Move dompurify to browser layer
* Fixing tests and how we check valid attributes
* Allow innerhtml in specific files
* Use isEqualNode instead of checking innerHTML directly
innerHTML can return different results on different browsers. Use `isEqualNode` instead
* Reapply fix for trusted types
* Enable ALLOW_UNKNOWN_PROTOCOLS
I beleive this is required since we allow links to commands and loading images over remote
* in -> of
* Fix check of protocol
* Enable two more safe tags
This switches our notebooks to always use contributed markdown rendering instead of our built-in markdown renderer
We'd held off on switching over due to accessibility. I've tried to address this using the `aria-describedby` attributed to link the markdown container with a copy of rendered (and sanitized) html from the webview.
For #120675
This uses a script to add the override keyword to places that need it in the codebase
Note that we can't enable the --noImplicitOverride setting yet since there are still around 200 errors that require further attention
Fixes#104329
This fixes two things:
- Keyup events from webviews were not dispatched back to the main window. We usually listen on keydown but the menubar listeners needs both keydown and keyup
- Instead of listening on document.body for keypress events, we need to listen on window
* WIP -Getting Started Registry
* Initial idea of how registry/service will work
* Getting started with Getting Started
* Add telemetry and touch up enablement flag
* Add contrib as startup editor
* Move to allowing static Getting Start blob
* No newline
* Remove unused enum
Fixes#100536
These commands currently do not work because:
- The use the `hasFocus` check in layout.ts
- This looks at the active element and checks if the active element has a parent in the editor dom
- However webviews are outside of the normal dom flow (since they cannot be reparented without being destroyred)
To fix this, this PR adds allows dom node to point to their explicit parent using `setParentFlowTo`. Instead of a normal ancestor check, we then check ancestors while observing the flow to parents of node
The webview element is then update to have a parent flow to that points at its editor node
