From 96aa9e07eeb6973deae939dddcd409a435ac4426 Mon Sep 17 00:00:00 2001
From: Amolith <amolith@secluded.site>
Date: Sun, 9 Nov 2025 18:23:35 -0700
Subject: [PATCH] feat(webui): allow details and summary tags

The Markdown sanitizer now preserves <details> and <summary> tags,
enabling collapsible sections in README files and blob views.

Added test coverage to verify these tags are properly preserved through
the sanitization process.

Closes: bug-f881844
Assisted-by: Claude Sonnet 4.5 via Crush
---
 pkg/web/sanitizer_test.go | 12 ++++++++++++
 pkg/web/webui_helpers.go  |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkg/web/sanitizer_test.go b/pkg/web/sanitizer_test.go
index 2228522ec786c43f5bb5b530478982b4ec2d54ca..85781211bc84dea915dfda4fb17d0c62a71258a3 100644
--- a/pkg/web/sanitizer_test.go
+++ b/pkg/web/sanitizer_test.go
@@ -148,6 +148,18 @@ func TestSanitizerAllowedTags(t *testing.T) {
 	html, err = renderMarkdown(md, ctx)
 	is.NoErr(err)
 	is.True(strings.Contains(string(html), "<blockquote"))
+
+	// Test allowed details/summary (collapsible sections)
+	md = []byte(`<details>
+<summary>Click to expand</summary>
+
+Hidden content here
+
+</details>`)
+	html, err = renderMarkdown(md, ctx)
+	is.NoErr(err)
+	is.True(strings.Contains(string(html), "<details"))
+	is.True(strings.Contains(string(html), "<summary"))
 }
 
 func TestSanitizerHTTPSOnly(t *testing.T) {
diff --git a/pkg/web/webui_helpers.go b/pkg/web/webui_helpers.go
index 94d5b821cc8ef1fab14997d84f13bc436c0a9623..e42deb27336fb83a093ec5a9688014e1bfaee6f6 100644
--- a/pkg/web/webui_helpers.go
+++ b/pkg/web/webui_helpers.go
@@ -36,7 +36,7 @@ func getSanitizerPolicy() *bluemonday.Policy {
 			"ul", "ol", "li", "pre", "code", "blockquote",
 			"strong", "em", "del", "br", "hr",
 			"table", "thead", "tbody", "tr", "th", "td",
-			"center", "a", "img")
+			"center", "a", "img", "details", "summary")
 
 		// Allow id attributes on headings (generated by AutoHeadingID for anchor links)
 		policy.AllowAttrs("id").OnElements("h1", "h2", "h3", "h4", "h5", "h6")