Markdown Renderer

Meerkat stores the submitted body as comment_text and provides sanitized HTML as comment_html.

Use comment_html for rendered comments:

1{{ comment_html }}

1{!! $comment_html !!}

#Supported Markdown

The renderer supports paragraphs, headings, links, images, emphasis, code, blockquotes, lists, and tables. Unknown HTML tags are removed.

#Sanitization

Meerkat removes executable, embedded, form, and metadata elements. It also removes:

• Event-handler attributes such as onclick.
• Inline styles.
• Unsupported attributes and image sources.
• Unsafe URL schemes such as javascript:, vbscript:, file:, and non-image data URLs.

Links and images may use http, https, relative URLs, and anchors. Links may also use mailto and tel. Images may use PNG, JPEG, GIF, or WebP data URLs; SVG data URLs are rejected.

Rendered links receive:

1target="_blank" rel="noopener noreferrer nofollow ugc"

#Customizing

Replace Stillat\Meerkat\Support\CommentMarkdownRenderer in a service provider when your site needs different Markdown behavior:

 1namespace App\Providers;
 2
 3use Illuminate\Support\ServiceProvider;
 4use Stillat\Meerkat\Support\CommentMarkdownRenderer;
 5
 6class AppServiceProvider extends ServiceProvider
 7{
 8    public function register(): void
 9    {
10        $this->app->bind(CommentMarkdownRenderer::class, \App\Comments\MyRenderer::class);
11    }
12}

The replacement must provide public function render(?string $text): string and sanitize user input before returning HTML. The Control Panel and public templates render comment_html without escaping it.