diff --git a/markup/goldmark/goldmark_integration_test.go b/markup/goldmark/goldmark_integration_test.go index 591226dc2..23e22b5ca 100644 --- a/markup/goldmark/goldmark_integration_test.go +++ b/markup/goldmark/goldmark_integration_test.go @@ -851,3 +851,54 @@ title: "p1" b.AssertFileContent("public/p1/index.html", "! ") b.AssertLogContains("! WARN") } + +// See https://github.com/gohugoio/hugo/issues/13278#issuecomment-2603280548 +func TestGoldmarkRawHTMLCommentNoWarning(t *testing.T) { + files := ` +-- hugo.toml -- +disableKinds = ['home','rss','section','sitemap','taxonomy','term'] +markup.goldmark.renderer.unsafe = false +-- content/p1.md -- +--- +title: "p1" +--- +# HTML comments + +## Simple + + + + + **Hello**_world_. +## With HTML + + + +## With HTML and JS + + + +## With Block + + + +XSS + + + +-- layouts/_default/single.html -- +{{ .Content }} +` + + b := hugolib.Test(t, files, hugolib.TestOptWarn()) + + b.AssertFileContent("public/p1/index.html", "! ") + b.AssertLogContains("! Raw HTML omitted") + + b = hugolib.Test(t, strings.ReplaceAll(files, "markup.goldmark.renderer.unsafe = false", "markup.goldmark.renderer.unsafe = true"), hugolib.TestOptWarn()) + b.AssertFileContent("public/p1/index.html", "") + b.AssertLogContains("! WARN") +} diff --git a/markup/goldmark/hugocontext/hugocontext.go b/markup/goldmark/hugocontext/hugocontext.go index 601014b37..e610bbbeb 100644 --- a/markup/goldmark/hugocontext/hugocontext.go +++ b/markup/goldmark/hugocontext/hugocontext.go @@ -174,6 +174,9 @@ func (r *hugoContextRenderer) renderHTMLBlock( w util.BufWriter, source []byte, node ast.Node, entering bool, ) (ast.WalkStatus, error) { n := node.(*ast.HTMLBlock) + isHTMLComment := func(b []byte) bool { + return len(b) > 4 && b[0] == '<' && b[1] == '!' && b[2] == '-' && b[3] == '-' + } if entering { if r.Unsafe { l := n.Lines().Len() @@ -188,8 +191,12 @@ func (r *hugoContextRenderer) renderHTMLBlock( r.Writer.SecureWrite(w, linev) } } else { - r.logRawHTMLEmittedWarn(w) - _, _ = w.WriteString("\n") + l := n.Lines().At(0) + v := l.Value(source) + if !isHTMLComment(v) { + r.logRawHTMLEmittedWarn(w) + _, _ = w.WriteString("\n") + } } } else { if n.HasClosure() { @@ -197,7 +204,11 @@ func (r *hugoContextRenderer) renderHTMLBlock( closure := n.ClosureLine r.Writer.SecureWrite(w, closure.Value(source)) } else { - _, _ = w.WriteString("\n") + l := n.Lines().At(0) + v := l.Value(source) + if !isHTMLComment(v) { + _, _ = w.WriteString("\n") + } } } }