Guard Markdown

CommonMark validator + sanitizer for user-supplied markdown. Refuses raw HTML by default, applies a URL-scheme allowlist on inline links / autolinks / images / reference defs, and caps image dimensions and structural depth to defang renderer DoS. KIND="content" — the gate consumes ctx.bytes / ctx.bodyText.

The primitive is a SOURCE-LEVEL gate: it inspects raw markdown text BEFORE any downstream renderer (marked / markdown-it / commonmark / remark / parsedown) sees it. Source-level discipline matters because the most dangerous shapes — __proto__ in JSON, in markdown — exploit specific parser internals; sanitizing on the post-parse tree is too late.

Threat catalog grounded in current CVE research: CVE-2026-30838 (CommonMark DisallowedRawHtml whitespace-tag bypass — / evades naive ", { profile: "strict" }); } catch (e) { e.code; // → "markdown.dangerous-tag" }

b.guardMarkdown.gate(opts?) #

{
  name:                   string,    // gate label for audit / observability
  profile:                "strict"|"balanced"|"permissive",
  compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  ...:                    same shape as b.guardMarkdown.validate opts,
}

Build a guard gate whose async check(ctx) returns { ok, action, issues }, consumable by b.guardAll, b.staticServe, b.fileUpload, and any host that ingests user-supplied markdown. The gate decodes ctx.bytes / ctx.bodyText, runs validate, and maps severity to action: zero issues serve; only low/medium audit-only; sanitizable issues sanitize (returning the cleaned bytes); any unfixable critical refuse.

var g = b.guardMarkdown.gate({ profile: "strict" });
var rv = await g.check({ bytes: Buffer.from("# hello\n", "utf8") });
rv.action;                                         // → "serve"

var bad = await g.check({ bytes: Buffer.from("[x](javascript:1)", "utf8") });
bad.action;                                        // → "refuse"

b.guardMarkdown.compliancePosture(name) #

Look up a compliance-posture overlay by name (one of "hipaa" / "pci-dss" / "gdpr" / "soc2"). Returns a fresh clone of the posture overlay so the caller may mutate it freely without disturbing the shared table. Throws GuardMarkdownError with code "markdown.bad-posture" when the name is not one this guard maps. Wired by gateContract.defineGuard through gateContract.lookupCompliancePosture, so the clone semantics and error code are identical across every guard in the family.

var posture = b.guardMarkdown.compliancePosture("hipaa");
posture;                                             // → overlay clone (mutable)

try {
  b.guardMarkdown.compliancePosture("not-a-regime");
} catch (e) {
  e.code;                                            // → "markdown.bad-posture"
}

b.guardMarkdown.buildProfile(opts) #

{
  extends:   string|string[],   // base profile name(s) to compose
  ...:       any guard key,      // inline override of resolved keys
}

Compose a derived profile from one or more named bases plus inline overrides, resolving names through this guard's own PROFILES table. opts.extends is a base profile name ("strict" / "balanced" / "permissive") or an array of names — later entries shadow earlier ones, and inline opts keys win last. Wired by gateContract.defineGuard through gateContract.makeProfileBuilder, so operator-defined profiles stay traceable to a baseline instead of a hand-typed dictionary.

var custom = b.guardMarkdown.buildProfile({ extends: "strict" });
custom;                                              // → composed profile object

b.guardMarkdown.loadRulePack(pack) #

Register an operator-supplied rule pack with this guard's rule-pack registry. The pack is identified by pack.id (a non-empty string) and stored for later dispatch by gates that opt in via opts.rulePackId. Returns the pack unchanged on success; throws GuardMarkdownError with code "markdown.bad-opt" when pack is missing or pack.id is not a non-empty string. Wired by gateContract.defineGuard through gateContract.makeRulePackLoader, so storage shape and validation are identical across the family.

var pack = b.guardMarkdown.loadRulePack({ id: "tenant-policy", rules: [] });
pack.id;                                             // → "tenant-policy"

b.guardMarkdown.resolveOpts(opts?) #

{
  profile:           string,    // one of PROFILES; default this guard's default
  compliancePosture: string,    // overlay one of hipaa/pci-dss/gdpr/soc2
}

Resolve caller opts against this guard's PROFILES + compliance-posture overlays into the fully-defaulted option set the guard runs on — the same resolution validate / sanitize / gate apply internally. Wired by gateContract.defineGuard from the guard's binding config (profiles / postures / defaults / error class), so a guard's bespoke gate calls resolveOpts instead of re-declaring the per-guard resolver wrapper. Throws GuardMarkdownError with code "markdown.bad-opt" / "markdown.bad-posture" on an unknown profile or posture name.

var resolved = b.guardMarkdown.resolveOpts({ profile: "strict" });
resolved.profile;                                    // → "strict"

Last updated 2026-08-08T16:39:49.652Z by seeder.