Backport #39337 by @nschloe
Follow-up to https://github.com/go-gitea/gitea/pull/38034.
bluemonday only keeps an element without attributes if it was registered
via `AllowNoAttrs`. The MathML rules only used
`AllowAttrs(...).OnElements(...)`, so plain `<mi>x</mi>`, `<mrow>`,
`<msqrt>` and friends were stripped to bare text. Since real-world
MathML is almost entirely attribute-less elements, nearly every formula
collapsed. The existing test missed it because its only case gave every
element an attribute.
Also fills the remaining gaps against MathML Core
(https://www.w3.org/TR/mathml-core/): `rowspan` on `mtd` alongside
`columnspan`, the `maction` element with `actiontype` and `selection`,
and the reserved global attributes `intent` and `arg`.
Tests cover attribute-less round-trips, table cell spans, and `maction`
with `intent`/`arg`.
Co-authored-by: Nico Schlömer <nschloe@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Follow up #33748
Now there are 3 "global" functions:
* registerGlobalSelectorFunc: for all elements matching the selector, eg: `.ui.dropdown`
* registerGlobalInitFunc: for `data-global-init="initInputAutoFocusEnd"`
* registerGlobalEventFunc: for `data-global-click="onCommentReactionButtonClick"`
And introduce `initGlobalInput` to replace old `initAutoFocusEnd` and
`attachDirAuto`, use `data-global-init` to replace fragile
`.js-autofocus-end` selector.
Another benefit is that by the new approach, no matter how many times
`registerGlobalInitFunc` is called, we only need to do one
"querySelectorAll" in the last step, it could slightly improve the
performance.
This PR removes (almost) all path tricks, and introduces "renderhelper"
package.
Now we can clearly see the rendering behaviors for comment/file/wiki,
more details are in "renderhelper" tests.
Fix#31411 , fix#18592, fix#25632 and maybe more problems. (ps: fix
#32608 by the way)
Remove unmaintainable sanitizer rules. No need to add special "class"
regexp rules anymore, use RenderInternal.SafeAttr instead, more details
(and examples) are in the tests
