<details></details> with empty line are not working on 0.11.2

[airosB]

<details>
aaa
bbb
</details>

is ok (appropriately collapsed) but

<details>

aaa
bbb
</details>

is not working.

So I couldn't get be collapsed some <details> with code block like this:

<details>

```
aaa
bbb
```

</details>

[Rokt33r]

@Redsandro I assume there is some problem in https://github.com/BoostIO/Boostnote/blob/master/browser/lib/markdown-it-sanitize-html.js
Do you know how to fix?

[Redsandro]

@Rokt33r There is no problem in the code you quoted, but rather a limitation in the way markdown-it works. Perhaps there is a better way to handle this, but we need input from someone who understands markdown-it better.

In the current implementation, this problem happens because this is a case of markdown-ception where you have markdown in html in markdown. The markdown is parsed only once and per markdown block, of which the sanitation is one step (after linkify).

Within this step, markdown-it supports hooks on html_block and inline, which are used directly to hook in the sanitizer. And since markdown-it sees the content as a markdown document, this means that the example given i.e.:

<details>

```
aaa
bbb
```

</details>

Is quite literally:

block 1 (html_block)

block 2 (markdown block)

block 3 (html block)

And each block is sanitized separately, so block 1 does not have complete html, and block 3 has no complete html, so the html is discarded, and block 2 is left.

I don't know how to fix this with the limitations of markdown-it. We need to either:

1. Experiment with different markdown-it token types and see if we can make it work, or:
2. Write our own complicated parser of sanitation that takes into account parents and childs of markdown in html in markdown, or:
3. Create a custom markdown tag for the details html element, and look at the > (quote) tag for inspiration, or:
4. Allow the user to opt-in to super-dangerous skipping of sanitation of any kind (tempting but absolutely not recommended because it's all fun until someone actually gets ransomwared)
5. Secret solution number 5 which I don't know about yet.

I'm rather busy at the moment with deadlines coming up so I'm hoping someone passionate about this problem can experiment or come up with something better.

[Redsandro]

Although

it could be something else that causes this, because I see the same problem with this code:

> hi
>
> ```
> test
> ```
> 
> ok

It breaks. It shouldn't. No html. Perhaps indeed a bug in the code you quoted. I don't see a fix. Help needed.

[airosB]

Before 0.11.0 this worked properly so I'm confused to hear that this problem is so deep-rooted.

[Redsandro]

@airosB before 0.11.0 there were no structure and security checks whatsoever. See #1634

[ZeroX-DG]

@airosB do you still have this problem in the latest version v0.11.13 ?

[airosB]

Sorry for long absence. It works properly on 0.11.13. Thanks everyone!