Repository navigation
Fix mermaid click + zone-map TP links under the /wiki deploy subpath - #10
Merged
Merged
Conversation
Two classes of links 404'd on the live GitHub Pages project site (served under /wiki/) while working locally at the root: 1. Mermaid diagram 'click' targets (item pages). The generators write them site-absolute (click b "/content/items/..."), and they live in code-fence text, not href/src attributes — so Zola and the CI rewrite pass both skip them. The page script now prefixes them with the base path part (read from body[data-root], "" locally / "/wiki" deployed) at the single pre->div conversion point, so both data-src and textContent carry the fixed source and refreshMermaid re-renders stay correct. No-op at the root. 2. Zone-map multi-destination teleport selector links (map.js) + inlined-map single-destination links (zone-map.js). Both read body[data-root] at parse time, but they load in <head> before <body> exists — so ROOT_PATH was "" forever and withRoot() a no-op. Make the read lazy (rootPath()) so the base path is picked up once the body is present. Tests: new subpath.spec.js (5 tests) in the 'subpath' Playwright project that mirrors the deploy; root regression in mermaid.spec.js proving click targets stay site-absolute and still navigate at the root.
CodeQL alert #1: DOM text from body[data-root] flows through withRoot() into window.location.href (the multi-dest TP selector) without sanitization. #4 already whitelisted the data-dests slug at the same sink; this does the same for the data-root prefix so a tampered value can never yield a scheme switch (e.g. javascript:) or non-path text. Whitelist [A-Za-z0-9/._-] after stripping the origin + trailing slash. Behavior is unchanged for the real values ("/" -> "", the Pages URL -> "/wiki"); only tampered input is cleaned. Verified: 13 subpath tests + 24 root map/zone-map tests pass.
Sellafield
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two classes of links 404'd on the live GitHub Pages project site (served under
/wiki/) while working locally at the root:1. Mermaid diagram
clicktargets (item pages). The generators write them site-absolute (click b "/content/items/...") and they live in code-fence text, nothref/srcattributes — so both Zola and the CI rewrite pass skip them. The page script now prefixes them with the base path part (read frombody[data-root],""locally //wikideployed) at the singlepre→divconversion point, so bothdata-srcandtextContentcarry the fixed source andrefreshMermaidre-renders stay correct. No-op at the root.2. Zone-map teleport links. The multi-destination selector links (
map.js) and inlined-map single-destination links (zone-map.js) both readbody[data-root]at parse time, but they load in<head>before<body>exists — soROOT_PATHwas""forever andwithRoot()a no-op. Made the read lazy (rootPath()) so the base path is picked up once the body is present.Files
templates/base.htmlfixMermaidClicks()prefixes site-absoluteclickURLs with the base path at the pre→div conversion (data-root pattern)static/map.jsrootPath()— body read at parse time was always null in<head>static/zone-map.jsrootPath()fixtests/subpath.spec.jstests/mermaid.spec.jsplaywright.config.jstestMatch/testIgnorenow includesubpath.spec.jsTests
tests/subpath.spec.js(5 tests) runs in thesubpathPlaywright project, which mirrors the deploy (same build served under/wiki/with the CI link rewrites +data-root).mermaid.spec.jsproving click targets stay site-absolute and still navigate at the root.Follows the i18n subpath fix (#8); this branch is a single clean commit on
main.