Skip to content

Fix mermaid click + zone-map TP links under the /wiki deploy subpath - #10

Merged
clouths merged 2 commits into
mainfrom
fix/mermaid-zonemap-subpath
Oct 15, 2026
Merged

clouths merged 2 commits into
mainfrom
fix/mermaid-zonemap-subpath

Conversation

@clouths

@clouths clouths commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

Two classes of links 404'd on the live GitHub Pages project site (served under /wiki/) while working locally at the root:

1. Mermaid diagram click targets (item pages). The generators write them site-absolute (click b "/content/items/...") and they live in code-fence text, not href/src attributes — so both Zola and the CI rewrite pass skip them. The page script now prefixes them with the base path part (read from body[data-root], "" locally / /wiki deployed) at the single pre→div conversion point, so both data-src and textContent carry the fixed source and refreshMermaid re-renders stay correct. No-op at the root.

2. Zone-map teleport links. The multi-destination selector links (map.js) and inlined-map single-destination links (zone-map.js) both read body[data-root] at parse time, but they load in <head> before <body> exists — so ROOT_PATH was "" forever and withRoot() a no-op. Made the read lazy (rootPath()) so the base path is picked up once the body is present.

Files

file change
templates/base.html fixMermaidClicks() prefixes site-absolute click URLs with the base path at the pre→div conversion (data-root pattern)
static/map.js lazy rootPath() — body read at parse time was always null in <head>
static/zone-map.js same lazy rootPath() fix
tests/subpath.spec.js new — 5 tests (3 mermaid click + 2 zone-map TP), subpath project only
tests/mermaid.spec.js root regression: click targets stay site-absolute + navigate at root
playwright.config.js subpath testMatch/testIgnore now include subpath.spec.js

Tests

  • New tests/subpath.spec.js (5 tests) runs in the subpath Playwright project, which mirrors the deploy (same build served under /wiki/ with the CI link rewrites + data-root).
  • Root regression added to mermaid.spec.js proving click targets stay site-absolute and still navigate at the root.
  • Full suite green locally: 186 passed, 77 skipped, 0 failed.

Follows the i18n subpath fix (#8); this branch is a single clean commit on main.

Two classes of links 404'd on the live GitHub Pages project site (served
under /wiki/) while working locally at the root:

1. Mermaid diagram 'click' targets (item pages). The generators write them
   site-absolute (click b "/content/items/..."), and they live in code-fence
   text, not href/src attributes — so Zola and the CI rewrite pass both skip
   them. The page script now prefixes them with the base path part (read from
   body[data-root], "" locally / "/wiki" deployed) at the single
   pre->div conversion point, so both data-src and textContent carry the fixed
   source and refreshMermaid re-renders stay correct. No-op at the root.

2. Zone-map multi-destination teleport selector links (map.js) + inlined-map
   single-destination links (zone-map.js). Both read body[data-root] at parse
   time, but they load in <head> before <body> exists — so ROOT_PATH was ""
   forever and withRoot() a no-op. Make the read lazy (rootPath()) so the base
   path is picked up once the body is present.

Tests: new subpath.spec.js (5 tests) in the 'subpath' Playwright project that
mirrors the deploy; root regression in mermaid.spec.js proving click targets
stay site-absolute and still navigate at the root.
@clouths clouths self-assigned this Oct 15, 2026
CodeQL alert #1: DOM text from body[data-root] flows through withRoot()
into window.location.href (the multi-dest TP selector) without
sanitization. #4 already whitelisted the data-dests slug at the same
sink; this does the same for the data-root prefix so a tampered value
can never yield a scheme switch (e.g. javascript:) or non-path text.

Whitelist [A-Za-z0-9/._-] after stripping the origin + trailing slash.
Behavior is unchanged for the real values ("/" -> "", the Pages URL ->
"/wiki"); only tampered input is cleaned. Verified: 13 subpath tests +
24 root map/zone-map tests pass.
@clouths
clouths merged commit 5249163 into main Oct 15, 2026
7 checks passed
@clouths
clouths deleted the fix/mermaid-zonemap-subpath branch October 15, 2026 16:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants