Quarkdown Files

Fixed

Lines of trailing whitespace no longer produce empty code blocks

A line consisting of 4 or more spaces, immediately after content, is no longer tokenized as an indented code block.

Empty code blocks no longer error out on the browser

Empty code blocks used to throw a runtime error, which also caused paged documents to break.

[Security] Prevent path traversal (CWE-22)

[!NOTE] The vulnerability was already unexploitable due to existing Ktor (Quarkdown's server library) security measures, and purely theoretical. This patch prevents any future regressions.

Prevented path traversal vulnerabilities that could allow attackers to access files outside the intended directory from the live preview endpoint (/live/).

Thanks to the GitLab Security team for reporting!

Sponsors

Thanks to our sponsors! 🎉

@vitto4