Markdown

latent_space.services.markdown

render_markdown_to_safe_html(markdown_text)

Render authored Markdown to sanitized HTML.

This is the single controlled pipeline for authored rich text (CLAUDE.md content conventions), so the sanitization allowlist lives in one place. Two steps run for defense in depth: the renderer is configured with html=False, so raw HTML in the source is escaped rather than emitted (and its default link validation refuses javascript:/data: URLs); the output then passes through an nh3 allowlist that guarantees only the formatting tags in _ALLOWED_HTML_TAGS - and, for links, only href/title - can reach the browser even if the renderer's behavior changes.