[BUG] Invalid markdown link breaks fider

[juan11iguel]

Self Hosted
0.22.0-99c010c16fcb53a22620c217b59181c02ffa892d

Describe the bug
Setting incorrect markdown in the welcome configuration breaks the app.

To Reproduce
Steps to reproduce the behavior:

1. In the administration settings, fill the welcome text box with invalid markdown such as link without actual link
2. Press save and now your fider instance is broken

ERROR [2024-12-19T22:17:18Z] [WEB] Error Trace: 
- app/middlewares/setup.go:133
- goroutine 51 [running]:
runtime/debug.Stack()
        /usr/local/go/src/runtime/debug/stack.go:24 +0x5e
github.com/getfider/fider/app/pkg/errors.Panicked({0x1bb7900?, 0xc00003e918?})
        /server/app/pkg/errors/errors.go:40 +0xb4
github.com/getfider/fider/app/cmd.routes.WebSetup.func16.1.2()
        /server/app/middlewares/setup.go:133 +0x45
panic({0x1bb7900?, 0xc00003e918?})
        /usr/local/go/src/runtime/panic.go:770 +0x132
github.com/gomarkdown/markdown/parser.IsSafeURL({0x0, 0x0, 0x0})
        /go/pkg/mod/github.com/gomarkdown/[email protected]/parser/parser.go:780 +0x1c5
github.com/gomarkdown/markdown/html.needSkipLink(0x9f7c93?, {0x0, 0x0, 0xc0001ab4a0?})
        /go/pkg/mod/github.com/gomarkdown/[email protected]/html/renderer.go:307 +0x5d
github.com/gomarkdown/markdown/html.(*Renderer).Link(0xc000426280, {0x1efdb80, 0xc0001ab4a0}, 0xc00012c700, 0x1)
        /go/pkg/mod/github.com/gomarkdown/[email protected]/html/renderer.go:503 +0x45
github.com/gomarkdown/markdown/html.(*Renderer).RenderNode(0xc000426280, {0x1efdb80, 0xc0001ab4a0}, {0x1f089c8?, 0xc00012c700}, 0x1)
        /go/pkg/mod/github.com/gomarkdown/[email protected]/html/renderer.go:1035 +0x6b7
github.com/gomarkdown/markdown.Render.func1({0x1f089c8?, 0xc00012c700?}, 0x80?)
        /go/pkg/mod/github.com/gomarkdown/[email protected]/markdown.go:63 +0x43
github.com/gomarkdown/markdown/ast.NodeVisitorFunc.Visit(0xc000482600?, {0x1f089c8?, 0xc00012c700?}, 0xe8?)
        /go/pkg/mod/github.com/gomarkdown/[email protected]/ast/node.go:574 +0x28
github.com/gomarkdown/markdown/ast.Walk({0x1f089c8, 0xc00012c700}, {0x1efff20, 0xc00021af60})
        /go/pkg/mod/github.com/gomarkdown/[email protected]/ast/node.go:546 +0x53
github.com/gomarkdown/markdown/ast.Walk({0x1f08f68, 0xc000482600}, {0x1efff20, 0xc00021af60})
        /go/pkg/mod/github.com/gomarkdown/[email protected]/ast/node.go:557 +0x128
github.com/gomarkdown/markdown/ast.Walk({0x1f08b30, 0xc000482420}, {0x1efff20, 0xc00021af60})
        /go/pkg/mod/github.com/gomarkdown/[email protected]/ast/node.go:557 +0x128
github.com/gomarkdown/markdown/ast.WalkFunc(...)
        /go/pkg/mod/github.com/gomarkdown/[email protected]/ast/node.go:580
github.com/gomarkdown/markdown.Render({0x1f08b30, 0xc000482420}, {0x1f04070, 0xc000426280})
        /go/pkg/mod/github.com/gomarkdown/[email protected]/markdown.go:62 +0xc9
github.com/gomarkdown/markdown.ToHTML({0xc0004fa700?, 0xc000187500?, 0x6a5?}, 0xa13b2e?, {0x1f04070, 0xc000426280})
        /go/pkg/mod/github.com/gomarkdown/[email protected]/markdown.go:84 +0xb1
github.com/getfider/fider/app/pkg/markdown.PlainText({0xc000187500, 0x6a5})
        /server/app/pkg/markdown/text.go:46 +0x5d
github.com/getfider/fider/app/cmd.routes.Index.func48(0xc00045ab60)
        /server/app/handlers/post.go:34 +0x288
github.com/getfider/fider/app/cmd.routes.CheckTenantPrivacy.func47.1(0xc00045ab60)
        /server/app/middlewares/tenant.go:112 +0x48
github.com/getfider/fider/app/cmd.routes.BlockPendingTenants.func40.1(0xc00045ab60)
        /server/app/middlewares/tenant.go:100 +0x87
github.com/getfider/fider/app/cmd.routes.RequireTenant.func27.1(0xc00045ab60)
        /server/app/middlewares/tenant.go:84 +0x6e
github.com/getfider/fider/app/cmd.routes.CSRF.func20.1(0xc00045ab60?)
        /server/app/middlewares/security.go:40 +0x8a
github.com/getfider/fider/app/cmd.routes.User.func17.1(0xc00045ab60)
        /server/app/middlewares/user.go:108 +0x563
github.com/getfider/fider/app/cmd.routes.Tenant.SingleTenant.func132.1(0xc00045ab60)
        /server/app/middlewares/tenant.go:38 +0xdb
github.com/getfider/fider/app/cmd.routes.WebSetup.func16.1(0xc00045ab60)
        /server/app/middlewares/setup.go:140 +0x255
github.com/getfider/fider/app/cmd.routes.Session.func12.1(0xc00045ab60)
        /server/app/middlewares/session.go:21 +0xcc
github.com/getfider/fider/app/cmd.routes.Compress.func8.1(0xc00045ab60)
        /server/app/middlewares/compress.go:36 +0x1bf
github.com/getfider/fider/app/cmd.routes.Secure.func7.1(0xc00045ab60)
        /server/app/middlewares/security.go:27 +0x1de
github.com/getfider/fider/app/cmd.routes.CatchPanic.func5.1(0xc000372070?)
        /server/app/middlewares/panic.go:20 +0x53
github.com/getfider/fider/app/pkg/web.(*Engine).handle.func1({0x1f037b0, 0xc00012c540}, 0xc000022d80, {0xc000450080, 0x1, 0x1efe680?})
        /server/app/pkg/web/engine.go:269 +0x116
github.com/julienschmidt/httprouter.(*Router).Handle.(*Router).saveMatchedRoutePath.func2({0x1f037b0, 0xc00012c540}, 0xc000022d80, {0x0?, 0x429cbb?, 0x0?})
        /go/pkg/mod/github.com/julienschmidt/[email protected]/router.go:240 +0x1bc
github.com/julienschmidt/httprouter.(*Router).ServeHTTP(0xc00013a900, {0x1f037b0, 0xc00012c540}, 0xc000022d80)
        /go/pkg/mod/github.com/julienschmidt/[email protected]/router.go:474 +0x1de
net/http.serverHandler.ServeHTTP({0xc0001aa420?}, {0x1f037b0?, 0xc00012c540?}, 0x6?)
        /usr/local/go/src/net/http/server.go:3142 +0x8e
net/http.(*conn).serve(0xc00036aa20, {0x1f04e90, 0xc00045fd70})
        /usr/local/go/src/net/http/server.go:2044 +0x5e8
created by net/http.(*Server).Serve in goroutine 37
        /usr/local/go/src/net/http/server.go:3290 +0x4b4
 (app/pkg/errors/errors.go:40)
- github.com/gomarkdown/markdown/parser.IsSafeURL:780 (app/pkg/errors/errors.go:39)
- runtime error: slice bounds out of range [:1] with capacity 0
INFO [2024-12-19T22:17:18Z] [WEB] GET https://ideas.psa.es/ finished with 500 in 11ms (panicked)

[juan11iguel]

UPDATE: Managed to fix it by logging to the Postgres db using a client (pgadmin), and fixing the invalid markdown at Databases/fider/Schemas/public/Tables/tenants/welcome_message

[mattwoberts]

I'll have a look at the markdown stuff - i don't think that's been touched for a while and looks like it could with some robustifications

[mattwoberts]

Hi @juan11iguel

Did you come across any other markdown that breaks fider?

THe issue with the blank link is that it breaks the SafeLink option here
https://github.com/getfider/fider/blob/main/app/pkg/markdown/markdown.go#L32

That option is supposed to make the link. But it panics with a blank link as per your test. I'm tempted to just remove it, since we also sanitise the HTML before showing it, so I think this is OK. The other option is we override the safelink but I'm not sure if it's worth the effort...