feat: vendor gitea 1.16.2

package/gitea/source/modules/markup/asciicast/asciicast.go

@@ -20,14 +20,12 @@ func init() {
 // See https://github.com/asciinema/asciinema/blob/develop/doc/asciicast-v2.md
 type Renderer struct{}
 
-// Name implements markup.Renderer
 func (Renderer) Name() string {
 	return "asciicast"
 }
 
-// Extensions implements markup.Renderer
-func (Renderer) Extensions() []string {
-	return []string{".cast"}
+func (Renderer) FileNamePatterns() []string {
+	return []string{"*.cast"}
 }
 
 const (
@@ -35,12 +33,10 @@ const (
 	playerSrcAttr   = "data-asciinema-player-src"
 )
 
-// SanitizerRules implements markup.Renderer
 func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 	return []setting.MarkupSanitizerRule{{Element: "div", AllowAttr: playerSrcAttr}}
 }
 
-// Render implements markup.Renderer
 func (Renderer) Render(ctx *markup.RenderContext, _ io.Reader, output io.Writer) error {
 	rawURL := fmt.Sprintf("%s/%s/%s/raw/%s/%s",
 		setting.AppSubURL,

package/gitea/source/modules/markup/camo.go

@@ -11,7 +11,6 @@ import (
 	"strings"
 
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
 )
 
 // CamoEncode encodes a lnk to fit with the go-camo and camo proxy links. The purposes of camo-proxy are:
@@ -27,7 +26,7 @@ func CamoEncode(link string) string {
 	macSum := b64encode(mac.Sum(nil))
 	encodedURL := b64encode([]byte(link))
 
-	return util.URLJoin(setting.Camo.ServerURL, macSum, encodedURL)
+	return strings.TrimSuffix(setting.Camo.ServerURL, "/") + "/" + macSum + "/" + encodedURL
 }
 
 func b64encode(data []byte) string {

package/gitea/source/modules/markup/common/footnote.go

@@ -405,9 +405,9 @@ func (r *FootnoteHTMLRenderer) renderFootnoteLink(w util.BufWriter, source []byt
 	if entering {
 		n := node.(*FootnoteLink)
 		is := strconv.Itoa(n.Index)
-		_, _ = w.WriteString(`<sup id="fnref:`)
+		_, _ = w.WriteString(`<sup id="fnref:user-content-`)
 		_, _ = w.Write(n.Name)
-		_, _ = w.WriteString(`"><a href="#fn:`)
+		_, _ = w.WriteString(`"><a href="#fn:user-content-`)
 		_, _ = w.Write(n.Name)
 		_, _ = w.WriteString(`" class="footnote-ref" role="doc-noteref">`) // FIXME: here and below, need to keep the classes
 		_, _ = w.WriteString(is)
@@ -419,7 +419,7 @@ func (r *FootnoteHTMLRenderer) renderFootnoteLink(w util.BufWriter, source []byt
 func (r *FootnoteHTMLRenderer) renderFootnoteBackLink(w util.BufWriter, source []byte, node ast.Node, entering bool) (ast.WalkStatus, error) {
 	if entering {
 		n := node.(*FootnoteBackLink)
-		_, _ = w.WriteString(` <a href="#fnref:`)
+		_, _ = w.WriteString(` <a href="#fnref:user-content-`)
 		_, _ = w.Write(n.Name)
 		_, _ = w.WriteString(`" class="footnote-backref" role="doc-backlink">`)
 		_, _ = w.WriteString("&#x21a9;&#xfe0e;")
@@ -431,7 +431,7 @@ func (r *FootnoteHTMLRenderer) renderFootnoteBackLink(w util.BufWriter, source [
 func (r *FootnoteHTMLRenderer) renderFootnote(w util.BufWriter, source []byte, node ast.Node, entering bool) (ast.WalkStatus, error) {
 	n := node.(*Footnote)
 	if entering {
-		_, _ = w.WriteString(`<li id="fn:`)
+		_, _ = w.WriteString(`<li id="fn:user-content-`)
 		_, _ = w.Write(n.Name)
 		_, _ = w.WriteString(`" role="doc-endnote"`)
 		if node.Attributes() != nil {

package/gitea/source/modules/markup/common/linkify.go

@@ -20,13 +20,13 @@ import (
 )
 
 type GlobalVarsType struct {
-	wwwURLRegxp *regexp.Regexp
-	LinkRegex   *regexp.Regexp // fast matching a URL link, no any extra validation.
+	wwwURLRegexp *regexp.Regexp
+	LinkRegex    *regexp.Regexp // fast matching a URL link, no any extra validation.
 }
 
 var GlobalVars = sync.OnceValue(func() *GlobalVarsType {
 	v := &GlobalVarsType{}
-	v.wwwURLRegxp = regexp.MustCompile(`^www\.[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}((?:/|[#?])[-a-zA-Z0-9@:%_\+.~#!?&//=\(\);,'">\^{}\[\]` + "`" + `]*)?`)
+	v.wwwURLRegexp = regexp.MustCompile(`^www\.[-a-zA-Z0-9@:%._\+~#=]{2,256}\.[a-z]{2,6}((?:/|[#?])[-a-zA-Z0-9@:%_\+.~#!?&//=\(\);,'">\^{}\[\]` + "`" + `]*)?`)
 	v.LinkRegex, _ = xurls.StrictMatchingScheme("https?://")
 	return v
 })
@@ -75,7 +75,7 @@ func (s *linkifyParser) Parse(parent ast.Node, block text.Reader, pc parser.Cont
 		m = GlobalVars().LinkRegex.FindSubmatchIndex(line)
 	}
 	if m == nil && bytes.HasPrefix(line, domainWWW) {
-		m = GlobalVars().wwwURLRegxp.FindSubmatchIndex(line)
+		m = GlobalVars().wwwURLRegexp.FindSubmatchIndex(line)
 		protocol = []byte("http")
 	}
 	if m != nil {
@@ -96,6 +96,7 @@ func (s *linkifyParser) Parse(parent ast.Node, block text.Reader, pc parser.Cont
 				m[1] -= closing
 			}
 		} else if lastChar == ';' {
+			// exclude HTML entity reference, e.g.: exclude " " from "http://example.com?foo=1 "
 			i := m[1] - 2
 			for ; i >= m[0]; i-- {
 				if util.IsAlphaNumeric(line[i]) {
@@ -105,7 +106,7 @@ func (s *linkifyParser) Parse(parent ast.Node, block text.Reader, pc parser.Cont
 			}
 			if i != m[1]-2 {
 				if line[i] == '&' {
-					m[1] -= m[1] - i
+					m[1] = i
 				}
 			}
 		}

package/gitea/source/modules/markup/console/console.go

@@ -20,29 +20,24 @@ func init() {
 	markup.RegisterRenderer(Renderer{})
 }
 
-// Renderer implements markup.Renderer
 type Renderer struct{}
 
 var _ markup.RendererContentDetector = (*Renderer)(nil)
 
-// Name implements markup.Renderer
 func (Renderer) Name() string {
 	return "console"
 }
 
-// Extensions implements markup.Renderer
-func (Renderer) Extensions() []string {
-	return []string{".sh-session"}
+func (Renderer) FileNamePatterns() []string {
+	return []string{"*.sh-session"}
 }
 
-// SanitizerRules implements markup.Renderer
 func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 	return []setting.MarkupSanitizerRule{
 		{Element: "span", AllowAttr: "class", Regexp: `^term-((fg[ix]?|bg)\d+|container)$`},
 	}
 }
 
-// CanRender implements markup.RendererContentDetector
 func (Renderer) CanRender(filename string, sniffedType typesniffer.SniffedType, prefetchBuf []byte) bool {
 	if !sniffedType.IsTextPlain() {
 		return false

package/gitea/source/modules/markup/csv/csv.go

@@ -20,20 +20,16 @@ func init() {
 	markup.RegisterRenderer(Renderer{})
 }
 
-// Renderer implements markup.Renderer for csv files
 type Renderer struct{}
 
-// Name implements markup.Renderer
 func (Renderer) Name() string {
 	return "csv"
 }
 
-// Extensions implements markup.Renderer
-func (Renderer) Extensions() []string {
-	return []string{".csv", ".tsv"}
+func (Renderer) FileNamePatterns() []string {
+	return []string{"*.csv", "*.tsv"}
 }
 
-// SanitizerRules implements markup.Renderer
 func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 	return []setting.MarkupSanitizerRule{
 		{Element: "table", AllowAttr: "class", Regexp: `^data-table$`},

package/gitea/source/modules/markup/external/external.go

@@ -21,10 +21,35 @@ import (
 
 // RegisterRenderers registers all supported third part renderers according settings
 func RegisterRenderers() {
+	markup.RegisterRenderer(&frontendRenderer{
+		name: "openapi-swagger",
+		patterns: []string{
+			"openapi.yaml",
+			"openapi.yml",
+			"openapi.json",
+			"swagger.yaml",
+			"swagger.yml",
+			"swagger.json",
+		},
+	})
+
+	markup.RegisterRenderer(&frontendRenderer{
+		name: "viewer-3d",
+		patterns: []string{
+			// It needs more logic to make it overall right (render a text 3D model automatically):
+			// we need to distinguish the ambiguous filename extensions.
+			// For example: "*.amf, *.obj, *.off, *.step" might be or not be a 3D model file.
+			// So when it is a text file, we can't assume that "we only render it by 3D plugin",
+			// otherwise the end users would be impossible to view its real content when the file is not a 3D model.
+			"*.3dm", "*.3ds", "*.3mf", "*.amf", "*.bim", "*.brep",
+			"*.dae", "*.fbx", "*.fcstd", "*.glb", "*.gltf",
+			"*.ifc", "*.igs", "*.iges", "*.stp", "*.step",
+			"*.stl", "*.obj", "*.off", "*.ply", "*.wrl",
+		},
+	})
+
 	for _, renderer := range setting.ExternalMarkupRenderers {
-		if renderer.Enabled && renderer.Command != "" && len(renderer.FileExtensions) > 0 {
-			markup.RegisterRenderer(&Renderer{renderer})
-		}
+		markup.RegisterRenderer(&Renderer{renderer})
 	}
 }
 
@@ -38,22 +63,18 @@ var (
 	_ markup.ExternalRenderer    = (*Renderer)(nil)
 )
 
-// Name returns the external tool name
 func (p *Renderer) Name() string {
 	return p.MarkupName
 }
 
-// NeedPostProcess implements markup.Renderer
 func (p *Renderer) NeedPostProcess() bool {
 	return p.MarkupRenderer.NeedPostProcess
 }
 
-// Extensions returns the supported extensions of the tool
-func (p *Renderer) Extensions() []string {
-	return p.FileExtensions
+func (p *Renderer) FileNamePatterns() []string {
+	return p.FilePatterns
 }
 
-// SanitizerRules implements markup.Renderer
 func (p *Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 	return p.MarkupSanitizerRules
 }

package/gitea/source/modules/markup/external/frontend.go

@@ -0,0 +1,95 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package external
+
+import (
+	"encoding/base64"
+	"io"
+	"unicode/utf8"
+
+	"code.gitea.io/gitea/modules/htmlutil"
+	"code.gitea.io/gitea/modules/markup"
+	"code.gitea.io/gitea/modules/public"
+	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/util"
+)
+
+type frontendRenderer struct {
+	name     string
+	patterns []string
+}
+
+var (
+	_ markup.PostProcessRenderer = (*frontendRenderer)(nil)
+	_ markup.ExternalRenderer    = (*frontendRenderer)(nil)
+)
+
+func (p *frontendRenderer) Name() string {
+	return p.name
+}
+
+func (p *frontendRenderer) NeedPostProcess() bool {
+	return false
+}
+
+func (p *frontendRenderer) FileNamePatterns() []string {
+	// TODO: the file extensions are ambiguous, even if the file name matches, it doesn't mean that the file is a 3D model
+	// There are some approaches to make it more accurate, but they are all complicated:
+	// A. Make backend know everything (detect a file is a 3D model or not)
+	// B. Let frontend renders to try render one by one
+	//
+	// If there would be more frontend renders in the future, we need to implement the "frontend" approach:
+	// 1. Make backend or parent window collect the supported extensions of frontend renders (done: backend external render framework)
+	// 2. If the current file matches any extension, start the general iframe embedded render (done: this renderer)
+	// 3. The iframe window calls the frontend renders one by one (done: frontend external render)
+	// 4. Report the render result to parent by postMessage (TODO: when needed)
+	return p.patterns
+}
+
+func (p *frontendRenderer) SanitizerRules() []setting.MarkupSanitizerRule {
+	return nil
+}
+
+func (p *frontendRenderer) GetExternalRendererOptions() (ret markup.ExternalRendererOptions) {
+	ret.SanitizerDisabled = true
+	ret.DisplayInIframe = true
+	ret.ContentSandbox = "allow-scripts allow-forms allow-modals allow-popups allow-downloads"
+	return ret
+}
+
+func (p *frontendRenderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
+	if ctx.RenderOptions.StandalonePageOptions == nil {
+		opts := p.GetExternalRendererOptions()
+		return markup.RenderIFrame(ctx, &opts, output)
+	}
+
+	content, err := util.ReadWithLimit(input, int(setting.UI.MaxDisplayFileSize))
+	if err != nil {
+		return err
+	}
+
+	contentEncoding, contentString := "text", util.UnsafeBytesToString(content)
+	if !utf8.Valid(content) {
+		contentEncoding = "base64"
+		contentString = base64.StdEncoding.EncodeToString(content)
+	}
+
+	_, err = htmlutil.HTMLPrintf(output,
+		`<!DOCTYPE html>
+<html>
+<head>
+	<!-- external-render-helper will be injected here by the markup render -->
+	<meta name="viewport" content="width=device-width, initial-scale=1">
+</head>
+<body>
+	<div id="frontend-render-viewer" data-frontend-renders="%s" data-file-tree-path="%s"></div>
+	<textarea id="frontend-render-data" data-content-encoding="%s" hidden>%s</textarea>
+	<script nonce type="module" src="%s"></script>
+</body>
+</html>`,
+		p.name, ctx.RenderOptions.RelativePath,
+		contentEncoding, contentString,
+		public.AssetURI("js/external-render-frontend.js"))
+	return err
+}

package/gitea/source/modules/markup/html.go

@@ -12,7 +12,9 @@ import (
 	"strings"
 	"sync"
 
+	"code.gitea.io/gitea/modules/htmlutil"
 	"code.gitea.io/gitea/modules/markup/common"
+	"code.gitea.io/gitea/modules/translation"
 
 	"golang.org/x/net/html"
 	"golang.org/x/net/html/atom"
@@ -60,7 +62,7 @@ var globalVars = sync.OnceValue(func() *globalVarsType {
 	v.shortLinkPattern = regexp.MustCompile(`\[\[(.*?)\]\](\w*)`)
 
 	// anyHashPattern splits url containing SHA into parts
-	v.anyHashPattern = regexp.MustCompile(`https?://(?:\S+/){4,5}([0-9a-f]{40,64})(/[-+~%./\w]+)?(\?[-+~%.\w&=]+)?(#[-+~%.\w]+)?`)
+	v.anyHashPattern = regexp.MustCompile(`https?://(?:\S+/){4,5}([0-9a-f]{40,64})((\.\w+)*)(/[-+~%./\w]+)?(\?[-+~%.\w&=]+)?(#[-+~%.\w]+)?`)
 
 	// comparePattern matches "http://domain/org/repo/compare/COMMIT1...COMMIT2#hash"
 	v.comparePattern = regexp.MustCompile(`https?://(?:\S+/){4,5}([0-9a-f]{7,64})(\.\.\.?)([0-9a-f]{7,64})?(#[-+~_%.a-zA-Z0-9]+)?`)
@@ -234,6 +236,49 @@ func postProcessString(ctx *RenderContext, procs []processor, content string) (s
 	return buf.String(), nil
 }
 
+func RenderTocHeadingItems(ctx *RenderContext, nodeDetailsAttrs map[string]string, out io.Writer) {
+	locale, ok := ctx.Value(translation.ContextKey).(translation.Locale)
+	if !ok {
+		locale = translation.NewLocale("")
+	}
+	_, _ = htmlutil.HTMLPrintTag(out, "details", nodeDetailsAttrs)
+	_, _ = htmlutil.HTMLPrintf(out, "<summary>%s</summary>\n", locale.TrString("toc"))
+
+	baseLevel := 6
+	for _, header := range ctx.TocHeadingItems {
+		if header.HeadingLevel < baseLevel {
+			baseLevel = header.HeadingLevel
+		}
+	}
+
+	currentLevel := baseLevel
+	indent := []byte{' ', ' '}
+	_, _ = htmlutil.HTMLPrint(out, "<ul>\n")
+	for _, header := range ctx.TocHeadingItems {
+		for currentLevel < header.HeadingLevel {
+			_, _ = out.Write(indent)
+			_, _ = htmlutil.HTMLPrint(out, "<ul>\n")
+			indent = append(indent, ' ', ' ')
+			currentLevel++
+		}
+		for currentLevel > header.HeadingLevel {
+			indent = indent[:len(indent)-2]
+			_, _ = out.Write(indent)
+			_, _ = htmlutil.HTMLPrint(out, "</ul>\n")
+			currentLevel--
+		}
+		_, _ = out.Write(indent)
+		_, _ = htmlutil.HTMLPrintf(out, "<li><a href=\"#%s\">%s</a></li>\n", header.AnchorID, header.InnerText)
+	}
+	for currentLevel > baseLevel {
+		indent = indent[:len(indent)-2]
+		_, _ = out.Write(indent)
+		_, _ = htmlutil.HTMLPrint(out, "</ul>\n")
+		currentLevel--
+	}
+	_, _ = htmlutil.HTMLPrint(out, "</ul>\n</details>\n")
+}
+
 func postProcess(ctx *RenderContext, procs []processor, input io.Reader, output io.Writer) error {
 	if !ctx.usedByRender && ctx.RenderHelper != nil {
 		defer ctx.RenderHelper.CleanUp()
@@ -284,6 +329,9 @@ func postProcess(ctx *RenderContext, procs []processor, input io.Reader, output
 	}
 
 	// Render everything to buf.
+	if ctx.TocShowInSection == TocShowInMain && len(ctx.TocHeadingItems) > 0 {
+		RenderTocHeadingItems(ctx, nil, output)
+	}
 	for _, node := range newNodes {
 		if err := html.Render(output, node); err != nil {
 			return fmt.Errorf("markup.postProcess: html.Render: %w", err)
@@ -314,7 +362,7 @@ func visitNode(ctx *RenderContext, procs []processor, node *html.Node) *html.Nod
 		return node.NextSibling
 	}
 
-	processNodeAttrID(node)
+	processNodeHeadingAndID(ctx, node)
 	processFootnoteNode(ctx, node) // FIXME: the footnote processing should be done in the "footnote.go" renderer directly
 
 	if isEmojiNode(node) {

package/gitea/source/modules/markup/html_commit.go

@@ -4,24 +4,27 @@
 package markup
 
 import (
+	"fmt"
 	"slices"
 	"strings"
 
 	"code.gitea.io/gitea/modules/base"
+	"code.gitea.io/gitea/modules/httplib"
 	"code.gitea.io/gitea/modules/references"
-	"code.gitea.io/gitea/modules/util"
 
 	"golang.org/x/net/html"
 	"golang.org/x/net/html/atom"
 )
 
 type anyHashPatternResult struct {
-	PosStart  int
-	PosEnd    int
-	FullURL   string
-	CommitID  string
-	SubPath   string
-	QueryHash string
+	PosStart    int
+	PosEnd      int
+	FullURL     string
+	CommitID    string
+	CommitExt   string
+	SubPath     string
+	QueryParams string
+	QueryHash   string
 }
 
 func createCodeLink(href, content, class string) *html.Node {
@@ -56,7 +59,11 @@ func anyHashPatternExtract(s string) (ret anyHashPatternResult, ok bool) {
 		return ret, false
 	}
 
-	ret.PosStart, ret.PosEnd = m[0], m[1]
+	pos := 0
+
+	ret.PosStart, ret.PosEnd = m[pos], m[pos+1]
+	pos += 2
+
 	ret.FullURL = s[ret.PosStart:ret.PosEnd]
 	if strings.HasSuffix(ret.FullURL, ".") {
 		// if url ends in '.', it's very likely that it is not part of the actual url but used to finish a sentence.
@@ -67,14 +74,24 @@ func anyHashPatternExtract(s string) (ret anyHashPatternResult, ok bool) {
 		}
 	}
 
-	ret.CommitID = s[m[2]:m[3]]
-	if m[5] > 0 {
-		ret.SubPath = s[m[4]:m[5]]
-	}
+	ret.CommitID = s[m[pos]:m[pos+1]]
+	pos += 2
 
-	lastStart, lastEnd := m[len(m)-2], m[len(m)-1]
-	if lastEnd > 0 {
-		ret.QueryHash = s[lastStart:lastEnd][1:]
+	ret.CommitExt = s[m[pos]:m[pos+1]]
+	pos += 4
+
+	if m[pos] > 0 {
+		ret.SubPath = s[m[pos]:m[pos+1]]
+	}
+	pos += 2
+
+	if m[pos] > 0 {
+		ret.QueryParams = s[m[pos]:m[pos+1]]
+	}
+	pos += 2
+
+	if m[pos] > 0 {
+		ret.QueryHash = s[m[pos]:m[pos+1]][1:]
 	}
 	return ret, true
 }
@@ -96,12 +113,20 @@ func fullHashPatternProcessor(ctx *RenderContext, node *html.Node) {
 			continue
 		}
 		text := base.ShortSha(ret.CommitID)
+		if ret.CommitExt != "" {
+			text += ret.CommitExt
+		}
 		if ret.SubPath != "" {
 			text += ret.SubPath
 		}
 		if ret.QueryHash != "" {
 			text += " (" + ret.QueryHash + ")"
 		}
+		// only turn commit links to the current instance into hash link
+		if !httplib.IsCurrentGiteaSiteURL(ctx, ret.FullURL) {
+			node = node.NextSibling
+			continue
+		}
 		replaceContent(node, ret.PosStart, ret.PosEnd, createCodeLink(ret.FullURL, text, "commit"))
 		node = node.NextSibling.NextSibling
 	}
@@ -148,6 +173,12 @@ func comparePatternProcessor(ctx *RenderContext, node *html.Node) {
 			}
 		}
 
+		// only turn compare links to the current instance into hash link
+		if !httplib.IsCurrentGiteaSiteURL(ctx, urlFull) {
+			node = node.NextSibling
+			continue
+		}
+
 		text := text1 + textDots + text2
 		if hash != "" {
 			text += " (" + hash + ")"
@@ -188,7 +219,7 @@ func hashCurrentPatternProcessor(ctx *RenderContext, node *html.Node) {
 			continue
 		}
 
-		link := "/:root/" + util.URLJoin(ctx.RenderOptions.Metas["user"], ctx.RenderOptions.Metas["repo"], "commit", hash)
+		link := fmt.Sprintf("/:root/%s/%s/commit/%s", ctx.RenderOptions.Metas["user"], ctx.RenderOptions.Metas["repo"], hash)
 		replaceContent(node, m[2], m[3], createCodeLink(link, base.ShortSha(hash), "commit"))
 		start = 0
 		node = node.NextSibling.NextSibling
@@ -205,7 +236,7 @@ func commitCrossReferencePatternProcessor(ctx *RenderContext, node *html.Node) {
 		}
 
 		refText := ref.Owner + "/" + ref.Name + "@" + base.ShortSha(ref.CommitSha)
-		linkHref := "/:root/" + util.URLJoin(ref.Owner, ref.Name, "commit", ref.CommitSha)
+		linkHref := fmt.Sprintf("/:root/%s/%s/commit/%s", ref.Owner, ref.Name, ref.CommitSha)
 		link := createLink(ctx, linkHref, refText, "commit")
 
 		replaceContent(node, ref.RefLocation.Start, ref.RefLocation.End, link)

package/gitea/source/modules/markup/html_internal_test.go

@@ -23,12 +23,12 @@ const (
 
 // externalIssueLink an HTML link to an alphanumeric-style issue
 func externalIssueLink(baseURL, class, name string) string {
-	return link(util.URLJoin(baseURL, name), class, name)
+	return link(strings.TrimSuffix(baseURL, "/")+"/"+name, class, name)
 }
 
 // numericLink an HTML to a numeric-style issue
 func numericIssueLink(baseURL, class string, index int, marker string) string {
-	return link(util.URLJoin(baseURL, strconv.Itoa(index)), class, fmt.Sprintf("%s%d", marker, index))
+	return link(strings.TrimSuffix(baseURL, "/")+"/"+strconv.Itoa(index), class, fmt.Sprintf("%s%d", marker, index))
 }
 
 // link an HTML link
@@ -116,7 +116,7 @@ func TestRender_IssueIndexPattern2(t *testing.T) {
 
 		links := make([]any, len(indices))
 		for i, index := range indices {
-			links[i] = numericIssueLink(util.URLJoin("/test-owner/test-repo", path), "ref-issue", index, marker)
+			links[i] = numericIssueLink("/test-owner/test-repo/"+path, "ref-issue", index, marker)
 		}
 		expectedNil := fmt.Sprintf(expectedFmt, links...)
 		testRenderIssueIndexPattern(t, s, expectedNil, NewTestRenderContext(TestAppURL, localMetas))
@@ -210,7 +210,7 @@ func TestRender_IssueIndexPattern5(t *testing.T) {
 		metas["regexp"] = pattern
 		links := make([]any, len(ids))
 		for i, id := range ids {
-			links[i] = link(util.URLJoin("https://someurl.com/someUser/someRepo/", id), "ref-issue ref-external-issue", names[i])
+			links[i] = link("https://someurl.com/someUser/someRepo/"+id, "ref-issue ref-external-issue", names[i])
 		}
 
 		expected := fmt.Sprintf(expectedFmt, links...)
@@ -288,18 +288,18 @@ func TestRender_AutoLink(t *testing.T) {
 	}
 
 	// render valid issue URLs
-	test(util.URLJoin(TestRepoURL, "issues", "3333"),
-		numericIssueLink(util.URLJoin(TestRepoURL, "issues"), "ref-issue", 3333, "#"))
+	test(TestRepoURL+"issues/3333",
+		numericIssueLink(TestRepoURL+"issues", "ref-issue", 3333, "#"))
 
 	// render valid commit URLs
-	tmp := util.URLJoin(TestRepoURL, "commit", "d8a994ef243349f321568f9e36d5c3f444b99cae")
+	tmp := TestRepoURL + "commit/d8a994ef243349f321568f9e36d5c3f444b99cae"
 	test(tmp, "<a href=\""+tmp+"\" class=\"commit\"><code>d8a994ef24</code></a>")
 	tmp += "#diff-2"
 	test(tmp, "<a href=\""+tmp+"\" class=\"commit\"><code>d8a994ef24 (diff-2)</code></a>")
 
 	// render other commit URLs
 	tmp = "https://external-link.gitea.io/go-gitea/gitea/commit/d8a994ef243349f321568f9e36d5c3f444b99cae#diff-2"
-	test(tmp, "<a href=\""+tmp+"\" class=\"commit\"><code>d8a994ef24 (diff-2)</code></a>")
+	test(tmp, "<a href=\""+tmp+"\">"+tmp+"</a>")
 }
 
 func TestRender_FullIssueURLs(t *testing.T) {

package/gitea/source/modules/markup/html_issue.go

@@ -4,6 +4,7 @@
 package markup
 
 import (
+	"fmt"
 	"strconv"
 	"strings"
 
@@ -162,7 +163,7 @@ func issueIndexPatternProcessor(ctx *RenderContext, node *html.Node) {
 			issueOwner := util.Iif(ref.Owner == "", ctx.RenderOptions.Metas["user"], ref.Owner)
 			issueRepo := util.Iif(ref.Owner == "", ctx.RenderOptions.Metas["repo"], ref.Name)
 			issuePath := util.Iif(ref.IsPull, "pulls", "issues")
-			linkHref := "/:root/" + util.URLJoin(issueOwner, issueRepo, issuePath, ref.Issue)
+			linkHref := fmt.Sprintf("/:root/%s/%s/%s/%s", issueOwner, issueRepo, issuePath, ref.Issue)
 
 			// at the moment, only render the issue index in a full line (or simple line) as icon+title
 			// otherwise it would be too noisy for "take #1 as an example" in a sentence

package/gitea/source/modules/markup/html_link.go

@@ -33,7 +33,7 @@ func shortLinkProcessor(ctx *RenderContext, node *html.Node) {
 		// Of text and link contents
 		sl := strings.SplitSeq(content, "|")
 		for v := range sl {
-			if equalPos := strings.IndexByte(v, '='); equalPos == -1 {
+			if found := strings.Contains(v, "="); !found {
 				// There is no equal in this argument; this is a mandatory arg
 				if props["name"] == "" {
 					if IsFullURLString(v) {
@@ -55,8 +55,8 @@ func shortLinkProcessor(ctx *RenderContext, node *html.Node) {
 			} else {
 				// There is an equal; optional argument.
 
-				sep := strings.IndexByte(v, '=')
-				key, val := v[:sep], html.UnescapeString(v[sep+1:])
+				before, after, _ := strings.Cut(v, "=")
+				key, val := before, html.UnescapeString(after)
 
 				// When parsing HTML, x/net/html will change all quotes which are
 				// not used for syntax into UTF-8 quotes. So checking val[0] won't
@@ -113,16 +113,17 @@ func shortLinkProcessor(ctx *RenderContext, node *html.Node) {
 		}
 		childNode.Parent = linkNode
 		absoluteLink := IsFullURLString(link)
-		if !absoluteLink {
+		// FIXME: it should be fully refactored in the future, it uses various hacky approaches to guess how to encode a path for wiki
+		// When a link contains "/", then we assume that the user has provided a well-encoded link.
+		if !absoluteLink && !strings.Contains(link, "/") {
+			// So only guess for links without "/".
 			if image {
 				link = strings.ReplaceAll(link, " ", "+")
 			} else {
 				// the hacky wiki name encoding: space to "-"
 				link = strings.ReplaceAll(link, " ", "-") // FIXME: it should support dashes in the link, eg: "the-dash-support.-"
 			}
-			if !strings.Contains(link, "/") {
-				link = url.PathEscape(link) // FIXME: it doesn't seem right and it might cause double-escaping
-			}
+			link = url.PathEscape(link)
 		}
 		if image {
 			title := props["title"]
@@ -208,7 +209,6 @@ func createDescriptionLink(href, content string) *html.Node {
 		Attr: []html.Attribute{
 			{Key: "href", Val: href},
 			{Key: "target", Val: "_blank"},
-			{Key: "rel", Val: "noopener noreferrer"},
 		},
 	}
 	textNode.Parent = linkNode

package/gitea/source/modules/markup/html_mention.go

@@ -4,6 +4,7 @@
 package markup
 
 import (
+	"fmt"
 	"strings"
 
 	"code.gitea.io/gitea/modules/references"
@@ -26,14 +27,11 @@ func mentionProcessor(ctx *RenderContext, node *html.Node) {
 		loc.End += start
 		mention := node.Data[loc.Start:loc.End]
 		teams, ok := ctx.RenderOptions.Metas["teams"]
-		// FIXME: util.URLJoin may not be necessary here:
-		// - setting.AppURL is defined to have a terminal '/' so unless mention[1:]
-		// is an AppSubURL link we can probably fallback to concatenation.
-		// team mention should follow @orgName/teamName style
+
 		if ok && strings.Contains(mention, "/") {
 			mentionOrgAndTeam := strings.Split(mention, "/")
 			if mentionOrgAndTeam[0][1:] == ctx.RenderOptions.Metas["org"] && strings.Contains(teams, ","+strings.ToLower(mentionOrgAndTeam[1])+",") {
-				link := "/:root/" + util.URLJoin("org", ctx.RenderOptions.Metas["org"], "teams", mentionOrgAndTeam[1])
+				link := fmt.Sprintf("/:root/org/%s/teams/%s", ctx.RenderOptions.Metas["org"], mentionOrgAndTeam[1])
 				replaceContent(node, loc.Start, loc.End, createLink(ctx, link, mention, "" /*mention*/))
 				node = node.NextSibling.NextSibling
 				start = 0

package/gitea/source/modules/markup/html_node.go

@@ -6,13 +6,15 @@ package markup
 import (
 	"strings"
 
+	"code.gitea.io/gitea/modules/markup/common"
+
 	"golang.org/x/net/html"
 )
 
 func isAnchorIDUserContent(s string) bool {
 	// blackfridayExtRegex is for blackfriday extensions create IDs like fn:user-content-footnote
 	// old logic: blackfridayExtRegex = regexp.MustCompile(`[^:]*:user-content-`)
-	return strings.HasPrefix(s, "user-content-") || strings.Contains(s, ":user-content-")
+	return strings.HasPrefix(s, "user-content-") || strings.Contains(s, ":user-content-") || isAnchorIDFootnote(s)
 }
 
 func isAnchorIDFootnote(s string) bool {
@@ -23,16 +25,80 @@ func isAnchorHrefFootnote(s string) bool {
 	return strings.HasPrefix(s, "#fnref:user-content-") || strings.HasPrefix(s, "#fn:user-content-")
 }
 
-func processNodeAttrID(node *html.Node) {
+// isHeadingTag returns true if the node is a heading tag (h1-h6)
+func isHeadingTag(node *html.Node) bool {
+	return node.Type == html.ElementNode &&
+		len(node.Data) == 2 &&
+		node.Data[0] == 'h' &&
+		node.Data[1] >= '1' && node.Data[1] <= '6'
+}
+
+// getNodeText extracts the text content from a node and its children
+func getNodeText(node *html.Node, cached **string) string {
+	if *cached != nil {
+		return **cached
+	}
+	var text strings.Builder
+	var extractText func(*html.Node)
+	extractText = func(n *html.Node) {
+		if n.Type == html.TextNode {
+			text.WriteString(n.Data)
+		}
+		for c := n.FirstChild; c != nil; c = c.NextSibling {
+			extractText(c)
+		}
+	}
+	extractText(node)
+	textStr := text.String()
+	*cached = &textStr
+	return textStr
+}
+
+func processNodeHeadingAndID(ctx *RenderContext, node *html.Node) {
+	// TODO: handle duplicate IDs, need to track existing IDs in the document
 	// Add user-content- to IDs and "#" links if they don't already have them,
 	// and convert the link href to a relative link to the host root
+	attrIDVal := ""
 	for idx, attr := range node.Attr {
 		if attr.Key == "id" {
-			if !isAnchorIDUserContent(attr.Val) {
-				node.Attr[idx].Val = "user-content-" + attr.Val
+			attrIDVal = attr.Val
+			if !isAnchorIDUserContent(attrIDVal) {
+				attrIDVal = "user-content-" + attrIDVal
+				node.Attr[idx].Val = attrIDVal
 			}
 		}
 	}
+
+	if !isHeadingTag(node) || !ctx.RenderOptions.EnableHeadingIDGeneration {
+		return
+	}
+
+	// For heading tags (h1-h6) without an id attribute, generate one from the text content.
+	// This ensures HTML headings like <h1>Title</h1> get proper permalink anchors
+	// matching the behavior of Markdown headings.
+	// Only enabled for repository files and wiki pages via EnableHeadingIDGeneration option.
+	var nodeTextCached *string
+	if attrIDVal == "" {
+		nodeText := getNodeText(node, &nodeTextCached)
+		if nodeText != "" {
+			// Use the same CleanValue function used by Markdown heading ID generation
+			attrIDVal = string(common.CleanValue([]byte(nodeText)))
+			if attrIDVal != "" {
+				attrIDVal = "user-content-" + attrIDVal
+				node.Attr = append(node.Attr, html.Attribute{Key: "id", Val: attrIDVal})
+			}
+		}
+	}
+	if ctx.TocShowInSection != "" {
+		nodeText := getNodeText(node, &nodeTextCached)
+		if nodeText != "" && attrIDVal != "" {
+			ctx.TocHeadingItems = append(ctx.TocHeadingItems, &TocHeadingItem{
+				HeadingLevel: int(node.Data[1] - '0'),
+				AnchorID:     attrIDVal,
+				InnerText:    nodeText,
+			})
+		}
+	}
 }
 
 func processFootnoteNode(ctx *RenderContext, node *html.Node) {

package/gitea/source/modules/markup/html_node_test.go

@@ -0,0 +1,104 @@
+// Copyright 2024 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package markup
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestProcessNodeAttrID_HTMLHeadingWithoutID(t *testing.T) {
+	// Test that HTML headings without id get an auto-generated id from their text content
+	// when EnableHeadingIDGeneration is true (for repo files and wiki pages)
+	testCases := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "h1 without id",
+			input:    `<h1>Heading without ID</h1>`,
+			expected: `<h1 id="user-content-heading-without-id">Heading without ID</h1>`,
+		},
+		{
+			name:     "h2 without id",
+			input:    `<h2>Another Heading</h2>`,
+			expected: `<h2 id="user-content-another-heading">Another Heading</h2>`,
+		},
+		{
+			name:     "h3 without id",
+			input:    `<h3>Third Level</h3>`,
+			expected: `<h3 id="user-content-third-level">Third Level</h3>`,
+		},
+		{
+			name:     "h1 with existing id should keep it",
+			input:    `<h1 id="my-custom-id">Heading with ID</h1>`,
+			expected: `<h1 id="user-content-my-custom-id">Heading with ID</h1>`,
+		},
+		{
+			name:     "h1 with user-content prefix should not double prefix",
+			input:    `<h1 id="user-content-already-prefixed">Already Prefixed</h1>`,
+			expected: `<h1 id="user-content-already-prefixed">Already Prefixed</h1>`,
+		},
+		{
+			name:     "heading with special characters",
+			input:    `<h1>What is Wine Staging?</h1>`,
+			expected: `<h1 id="user-content-what-is-wine-staging">What is Wine Staging?</h1>`,
+		},
+		{
+			name:     "heading with nested elements",
+			input:    `<h2><strong>Bold</strong> and <em>Italic</em></h2>`,
+			expected: `<h2 id="user-content-bold-and-italic"><strong>Bold</strong> and <em>Italic</em></h2>`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var result strings.Builder
+			ctx := NewTestRenderContext().WithEnableHeadingIDGeneration(true)
+			err := PostProcessDefault(ctx, strings.NewReader(tc.input), &result)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expected, strings.TrimSpace(result.String()))
+		})
+	}
+}
+
+func TestProcessNodeAttrID_SkipHeadingIDForComments(t *testing.T) {
+	// Test that HTML headings in comment-like contexts (issue comments)
+	// do NOT get auto-generated IDs to avoid duplicate IDs on pages with multiple documents.
+	// This is controlled by EnableHeadingIDGeneration which defaults to false.
+	testCases := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "h1 without id in comment context",
+			input:    `<h1>Heading without ID</h1>`,
+			expected: `<h1>Heading without ID</h1>`,
+		},
+		{
+			name:     "h2 without id in comment context",
+			input:    `<h2>Another Heading</h2>`,
+			expected: `<h2>Another Heading</h2>`,
+		},
+		{
+			name:     "h1 with existing id should still be prefixed",
+			input:    `<h1 id="my-custom-id">Heading with ID</h1>`,
+			expected: `<h1 id="user-content-my-custom-id">Heading with ID</h1>`,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			var result strings.Builder
+			// Default context without EnableHeadingIDGeneration (simulates comment rendering)
+			err := PostProcessDefault(NewTestRenderContext(), strings.NewReader(tc.input), &result)
+			assert.NoError(t, err)
+			assert.Equal(t, tc.expected, strings.TrimSpace(result.String()))
+		})
+	}
+}

package/gitea/source/modules/markup/html_test.go

@@ -34,15 +34,15 @@ func TestRender_Commits(t *testing.T) {
 
 	sha := "65f1bf27bc3bf70f64657658635e66094edbcb4d"
 	repo := markup.TestAppURL + testRepoOwnerName + "/" + testRepoName + "/"
-	commit := util.URLJoin(repo, "commit", sha)
+	commit := repo + "commit/" + sha
 	commitPath := "/user13/repo11/commit/" + sha
-	tree := util.URLJoin(repo, "tree", sha, "src")
+	tree := repo + "tree/" + sha + "/src"
 
-	file := util.URLJoin(repo, "commit", sha, "example.txt")
+	file := repo + "commit/" + sha + "/example.txt"
 	fileWithExtra := file + ":"
 	fileWithHash := file + "#L2"
 	fileWithHasExtra := file + "#L2:"
-	commitCompare := util.URLJoin(repo, "compare", sha+"..."+sha)
+	commitCompare := repo + "compare/" + sha + "..." + sha
 	commitCompareWithHash := commitCompare + "#L2"
 
 	test(sha, `<p><a href="`+commitPath+`" rel="nofollow"><code>65f1bf27bc</code></a></p>`)
@@ -71,6 +71,7 @@ func TestRender_Commits(t *testing.T) {
 }
 
 func TestRender_CrossReferences(t *testing.T) {
+	defer testModule.MockVariableValue(&setting.AppURL, markup.TestAppURL)()
 	defer testModule.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 	test := func(input, expected string) {
 		rctx := markup.NewTestRenderContext(markup.TestAppURL, localMetas).WithRelativePath("a.md")
@@ -89,19 +90,29 @@ func TestRender_CrossReferences(t *testing.T) {
 		"/home/gitea/go-gitea/gitea#12345",
 		`<p>/home/gitea/go-gitea/gitea#12345</p>`)
 	test(
-		util.URLJoin(markup.TestAppURL, "gogitea", "gitea", "issues", "12345"),
-		`<p><a href="`+util.URLJoin(markup.TestAppURL, "gogitea", "gitea", "issues", "12345")+`" class="ref-issue" rel="nofollow">gogitea/gitea#12345</a></p>`)
+		markup.TestAppURL+"gogitea/gitea/issues/12345",
+		`<p><a href="`+markup.TestAppURL+`gogitea/gitea/issues/12345" class="ref-issue" rel="nofollow">gogitea/gitea#12345</a></p>`)
 	test(
-		util.URLJoin(markup.TestAppURL, "go-gitea", "gitea", "issues", "12345"),
-		`<p><a href="`+util.URLJoin(markup.TestAppURL, "go-gitea", "gitea", "issues", "12345")+`" class="ref-issue" rel="nofollow">go-gitea/gitea#12345</a></p>`)
+		markup.TestAppURL+"go-gitea/gitea/issues/12345",
+		`<p><a href="`+markup.TestAppURL+`go-gitea/gitea/issues/12345" class="ref-issue" rel="nofollow">go-gitea/gitea#12345</a></p>`)
 	test(
-		util.URLJoin(markup.TestAppURL, "gogitea", "some-repo-name", "issues", "12345"),
-		`<p><a href="`+util.URLJoin(markup.TestAppURL, "gogitea", "some-repo-name", "issues", "12345")+`" class="ref-issue" rel="nofollow">gogitea/some-repo-name#12345</a></p>`)
+		markup.TestAppURL+"gogitea/some-repo-name/issues/12345",
+		`<p><a href="`+markup.TestAppURL+`gogitea/some-repo-name/issues/12345" class="ref-issue" rel="nofollow">gogitea/some-repo-name#12345</a></p>`)
 
-	inputURL := "https://host/a/b/commit/0123456789012345678901234567890123456789/foo.txt?a=b#L2-L3"
+	inputURL := setting.AppURL + "a/b/commit/0123456789012345678901234567890123456789/foo.txt?a=b#L2-L3"
 	test(
 		inputURL,
 		`<p><a href="`+inputURL+`" rel="nofollow"><code>0123456789/foo.txt (L2-L3)</code></a></p>`)
+
+	inputURL = setting.AppURL + "repo/owner/archive/0123456789012345678901234567890123456789.tar.gz"
+	test(
+		inputURL,
+		`<p><a href="`+inputURL+`" rel="nofollow"><code>0123456789.tar.gz</code></a></p>`)
+
+	inputURL = setting.AppURL + "owner/repo/commit/0123456789012345678901234567890123456789.patch?key=val"
+	test(
+		inputURL,
+		`<p><a href="`+inputURL+`" rel="nofollow"><code>0123456789.patch</code></a></p>`)
 }
 
 func TestRender_links(t *testing.T) {
@@ -364,7 +375,7 @@ func TestRender_emoji(t *testing.T) {
 
 func TestRender_ShortLinks(t *testing.T) {
 	setting.AppURL = markup.TestAppURL
-	tree := util.URLJoin(markup.TestRepoURL, "src", "master")
+	tree := markup.TestRepoURL + "src/master"
 
 	test := func(input, expected string) {
 		buffer, err := markdown.RenderString(markup.NewTestRenderContext(tree), input)
@@ -372,15 +383,15 @@ func TestRender_ShortLinks(t *testing.T) {
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(string(buffer)))
 	}
 
-	url := util.URLJoin(tree, "Link")
-	otherURL := util.URLJoin(tree, "Other-Link")
-	encodedURL := util.URLJoin(tree, "Link%3F")
-	imgurl := util.URLJoin(tree, "Link.jpg")
-	otherImgurl := util.URLJoin(tree, "Link+Other.jpg")
-	encodedImgurl := util.URLJoin(tree, "Link+%23.jpg")
-	notencodedImgurl := util.URLJoin(tree, "some", "path", "Link+#.jpg")
-	renderableFileURL := util.URLJoin(tree, "markdown_file.md")
-	unrenderableFileURL := util.URLJoin(tree, "file.zip")
+	url := tree + "/Link"
+	otherURL := tree + "/Other-Link"
+	encodedURL := tree + "/Link%3F"
+	imgurl := tree + "/Link.jpg"
+	otherImgurl := tree + "/Link+Other.jpg"
+	encodedImgurl := tree + "/Link+%23.jpg"
+	notencodedImgurl := tree + "/some/path/Link%20#.jpg"
+	renderableFileURL := tree + "/markdown_file.md"
+	unrenderableFileURL := tree + "/file.zip"
 	favicon := "http://google.com/favicon.ico"
 
 	test(
@@ -455,6 +466,8 @@ func TestRender_ShortLinks(t *testing.T) {
 		"[[Name|Link #.jpg|alt=\"AltName\"|title='Title']]",
 		`<p><a href="`+encodedImgurl+`" rel="nofollow"><img src="`+encodedImgurl+`" title="Title" alt="AltName"/></a></p>`,
 	)
+	// FIXME: it's unable to resolve: [[link?k=v]]
+	// FIXME: it is a wrong test case, it is not an image, but a link with anchor "#.jpg"
 	test(
 		"[[some/path/Link #.jpg]]",
 		`<p><a href="`+notencodedImgurl+`" rel="nofollow"><img src="`+notencodedImgurl+`" title="Link #.jpg" alt="some/path/Link #.jpg"/></a></p>`,
@@ -565,13 +578,15 @@ func TestFuzz(t *testing.T) {
 }
 
 func TestIssue18471(t *testing.T) {
-	data := `http://domain/org/repo/compare/783b039...da951ce`
+	defer testModule.MockVariableValue(&setting.AppURL, markup.TestAppURL)()
+
+	data := markup.TestAppURL + `org/repo/compare/783b039...da951ce`
 
 	var res strings.Builder
 	err := markup.PostProcessDefault(markup.NewTestRenderContext(localMetas), strings.NewReader(data), &res)
 
 	assert.NoError(t, err)
-	assert.Equal(t, `<a href="http://domain/org/repo/compare/783b039...da951ce" class="compare"><code>783b039...da951ce</code></a>`, res.String())
+	assert.Equal(t, `<a href="`+markup.TestAppURL+`org/repo/compare/783b039...da951ce" class="compare"><code>783b039...da951ce</code></a>`, res.String())
 }
 
 func TestIsFullURL(t *testing.T) {

package/gitea/source/modules/markup/html_toc_test.go

@@ -0,0 +1,60 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package markup_test
+
+import (
+	"regexp"
+	"testing"
+
+	"code.gitea.io/gitea/modules/markup"
+	"code.gitea.io/gitea/modules/markup/markdown"
+	"code.gitea.io/gitea/modules/test"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestToCWithHTML(t *testing.T) {
+	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
+
+	t1 := `tag <a href="link">link</a> and <b>Bold</b>`
+	t2 := "code block `<a>`"
+	t3 := "markdown **bold**"
+	input := `---
+include_toc: true
+---
+
+# ` + t1 + `
+## ` + t2 + `
+#### ` + t3 + `
+## last
+`
+
+	renderCtx := markup.NewTestRenderContext().WithEnableHeadingIDGeneration(true)
+	resultHTML, err := markdown.RenderString(renderCtx, input)
+	assert.NoError(t, err)
+	result := string(resultHTML)
+	re := regexp.MustCompile(`(?s)<details class="frontmatter-content">.*?</details>`)
+	result = re.ReplaceAllString(result, "\n")
+	expected := `<details><summary>toc</summary>
+<ul>
+  <li><a href="#user-content-tag-link-and-bold" rel="nofollow">tag link and Bold</a></li>
+  <ul>
+    <li><a href="#user-content-code-block-a" rel="nofollow">code block &lt;a&gt;</a></li>
+    <ul>
+      <ul>
+        <li><a href="#user-content-markdown-bold" rel="nofollow">markdown bold</a></li>
+      </ul>
+    </ul>
+    <li><a href="#user-content-last" rel="nofollow">last</a></li>
+  </ul>
+</ul>
+</details>
+
+<h1 id="user-content-tag-link-and-bold">tag <a href="/link" rel="nofollow">link</a> and <b>Bold</b></h1>
+<h2 id="user-content-code-block-a">code block <code>&lt;a&gt;</code></h2>
+<h4 id="user-content-markdown-bold">markdown <strong>bold</strong></h4>
+<h2 id="user-content-last">last</h2>
+`
+	assert.Equal(t, expected, result)
+}

package/gitea/source/modules/markup/main_test.go

@@ -14,5 +14,7 @@ import (
 func TestMain(m *testing.M) {
 	setting.IsInTesting = true
 	markup.RenderBehaviorForTesting.DisableAdditionalAttributes = true
+	setting.Markdown.FileNamePatterns = []string{"*.md"}
+	markup.RefreshFileNamePatterns()
 	os.Exit(m.Run())
 }

package/gitea/source/modules/markup/markdown/goldmark.go

@@ -41,11 +41,10 @@ func (g *ASTTransformer) applyElementDir(n ast.Node) {
 // Transform transforms the given AST tree.
 func (g *ASTTransformer) Transform(node *ast.Document, reader text.Reader, pc parser.Context) {
 	firstChild := node.FirstChild()
-	tocMode := ""
 	ctx := pc.Get(renderContextKey).(*markup.RenderContext)
 	rc := pc.Get(renderConfigKey).(*RenderConfig)
 
-	tocList := make([]Header, 0, 20)
+	tocMode := ""
 	if rc.yamlNode != nil {
 		metaNode := rc.toMetaNode(g)
 		if metaNode != nil {
@@ -60,8 +59,6 @@ func (g *ASTTransformer) Transform(node *ast.Document, reader text.Reader, pc pa
 		}
 
 		switch v := n.(type) {
-		case *ast.Heading:
-			g.transformHeading(ctx, v, reader, &tocList)
 		case *ast.Paragraph:
 			g.applyElementDir(v)
 		case *ast.List:
@@ -79,19 +76,18 @@ func (g *ASTTransformer) Transform(node *ast.Document, reader text.Reader, pc pa
 		return ast.WalkContinue, nil
 	})
 
-	showTocInMain := tocMode == "true" /* old behavior, in main view */ || tocMode == "main"
-	showTocInSidebar := !showTocInMain && tocMode != "false" // not hidden, not main, then show it in sidebar
-	if len(tocList) > 0 && (showTocInMain || showTocInSidebar) {
-		if showTocInMain {
-			tocNode := createTOCNode(tocList, rc.Lang, nil)
-			node.InsertBefore(node, firstChild, tocNode)
-		} else {
-			tocNode := createTOCNode(tocList, rc.Lang, map[string]string{"open": "open"})
-			ctx.SidebarTocNode = tocNode
+	if ctx.RenderOptions.EnableHeadingIDGeneration {
+		showTocInMain := tocMode == "true" /* old behavior, in main view */ || tocMode == "main"
+		showTocInSidebar := !showTocInMain && tocMode != "false" // not hidden, not main, then show it in sidebar
+		switch {
+		case showTocInMain:
+			ctx.TocShowInSection = markup.TocShowInMain
+		case showTocInSidebar:
+			ctx.TocShowInSection = markup.TocShowInSidebar
 		}
 	}
 
-	if len(rc.Lang) > 0 {
+	if rc.Lang != "" {
 		node.SetAttributeString("lang", []byte(rc.Lang))
 	}
 }

package/gitea/source/modules/markup/markdown/markdown.go

@@ -5,6 +5,7 @@
 package markdown
 
 import (
+	"bytes"
 	"errors"
 	"html/template"
 	"io"
@@ -20,11 +21,12 @@ import (
 	chromahtml "github.com/alecthomas/chroma/v2/formatters/html"
 	"github.com/yuin/goldmark"
 	highlighting "github.com/yuin/goldmark-highlighting/v2"
-	meta "github.com/yuin/goldmark-meta"
+	"github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/extension"
 	"github.com/yuin/goldmark/parser"
 	"github.com/yuin/goldmark/renderer"
 	"github.com/yuin/goldmark/renderer/html"
+	"github.com/yuin/goldmark/text"
 	"github.com/yuin/goldmark/util"
 )
 
@@ -57,7 +59,7 @@ func (l *limitWriter) Write(data []byte) (int, error) {
 
 // newParserContext creates a parser.Context with the render context set
 func newParserContext(ctx *markup.RenderContext) parser.Context {
-	pc := parser.NewContext(parser.WithIDs(newPrefixedIDs()))
+	pc := parser.NewContext()
 	pc.Set(renderContextKey, ctx)
 	return pc
 }
@@ -101,12 +103,48 @@ func (r *GlodmarkRender) highlightingRenderer(w util.BufWriter, c highlighting.C
 	}
 }
 
+type goldmarkEmphasisParser struct {
+	parser.InlineParser
+}
+
+func goldmarkNewEmphasisParser() parser.InlineParser {
+	return &goldmarkEmphasisParser{parser.NewEmphasisParser()}
+}
+
+func (s *goldmarkEmphasisParser) Parse(parent ast.Node, block text.Reader, pc parser.Context) ast.Node {
+	line, _ := block.PeekLine()
+	if len(line) > 1 && line[0] == '_' {
+		// a special trick to avoid parsing emphasis in filenames like "module/__init__.py"
+		end := bytes.IndexByte(line[1:], '_')
+		mark := bytes.Index(line, []byte("_.py"))
+		// check whether the "end" matches "_.py" or "__.py"
+		if mark != -1 && (end == mark || end == mark-1) {
+			return nil
+		}
+	}
+	return s.InlineParser.Parse(parent, block, pc)
+}
+
+func goldmarkDefaultParser() parser.Parser {
+	return parser.NewParser(parser.WithBlockParsers(parser.DefaultBlockParsers()...),
+		parser.WithInlineParsers([]util.PrioritizedValue{
+			util.Prioritized(parser.NewCodeSpanParser(), 100),
+			util.Prioritized(parser.NewLinkParser(), 200),
+			util.Prioritized(parser.NewAutoLinkParser(), 300),
+			util.Prioritized(parser.NewRawHTMLParser(), 400),
+			util.Prioritized(goldmarkNewEmphasisParser(), 500),
+		}...),
+		parser.WithParagraphTransformers(parser.DefaultParagraphTransformers()...),
+	)
+}
+
 // SpecializedMarkdown sets up the Gitea specific markdown extensions
 func SpecializedMarkdown(ctx *markup.RenderContext) *GlodmarkRender {
 	// TODO: it could use a pool to cache the renderers to reuse them with different contexts
 	// at the moment it is fast enough (see the benchmarks)
 	r := &GlodmarkRender{ctx: ctx}
 	r.goldmarkMarkdown = goldmark.New(
+		goldmark.WithParser(goldmarkDefaultParser()),
 		goldmark.WithExtensions(
 			extension.NewTable(extension.WithTableCellAlignMethod(extension.TableCellAlignAttribute)),
 			extension.Strikethrough,
@@ -127,11 +165,9 @@ func SpecializedMarkdown(ctx *markup.RenderContext) *GlodmarkRender {
 				ParseBlockDollar:         setting.Markdown.MathCodeBlockOptions.ParseBlockDollar,
 				ParseBlockSquareBrackets: setting.Markdown.MathCodeBlockOptions.ParseBlockSquareBrackets, //  this is a bad syntax "\[ ... \]", it conflicts with normal markdown escaping
 			}),
-			meta.Meta,
 		),
 		goldmark.WithParserOptions(
 			parser.WithAttribute(),
-			parser.WithAutoHeadingID(),
 			parser.WithASTTransformers(util.Prioritized(NewASTTransformer(&ctx.RenderInternal), 10000)),
 		),
 		goldmark.WithRendererOptions(html.WithUnsafe()),
@@ -202,30 +238,24 @@ func init() {
 	markup.RegisterRenderer(Renderer{})
 }
 
-// Renderer implements markup.Renderer
 type Renderer struct{}
 
 var _ markup.PostProcessRenderer = (*Renderer)(nil)
 
-// Name implements markup.Renderer
 func (Renderer) Name() string {
 	return MarkupName
 }
 
-// NeedPostProcess implements markup.PostProcessRenderer
 func (Renderer) NeedPostProcess() bool { return true }
 
-// Extensions implements markup.Renderer
-func (Renderer) Extensions() []string {
-	return setting.Markdown.FileExtensions
+func (Renderer) FileNamePatterns() []string {
+	return setting.Markdown.FileNamePatterns
 }
 
-// SanitizerRules implements markup.Renderer
 func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 	return []setting.MarkupSanitizerRule{}
 }
 
-// Render implements markup.Renderer
 func (Renderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
 	return render(ctx, input, output)
 }
@@ -240,7 +270,9 @@ func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error
 func RenderString(ctx *markup.RenderContext, content string) (template.HTML, error) {
 	var buf strings.Builder
 	if err := Render(ctx, strings.NewReader(content), &buf); err != nil {
-		return "", err
+		log.Warn("Unable to RenderString: %v, content: %s", err, giteautil.TruncateRunes(content, 200))
+		err = nil
+		return template.HTML(template.HTMLEscapeString(content)), err
 	}
 	return template.HTML(buf.String()), nil
 }

package/gitea/source/modules/markup/markdown/markdown_test.go

@@ -14,7 +14,6 @@ import (
 	"code.gitea.io/gitea/modules/markup/markdown"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/util"
 
 	"github.com/stretchr/testify/assert"
 )
@@ -23,7 +22,6 @@ const (
 	AppURL            = "http://localhost:3000/"
 	testRepoOwnerName = "user13"
 	testRepoName      = "repo11"
-	FullURL           = AppURL + testRepoOwnerName + "/" + testRepoName + "/"
 )
 
 // these values should match the const above
@@ -47,8 +45,9 @@ func TestRender_StandardLinks(t *testing.T) {
 func TestRender_Images(t *testing.T) {
 	setting.AppURL = AppURL
 
+	const baseLink = "http://localhost:3000/user13/repo11"
 	render := func(input, expected string) {
-		buffer, err := markdown.RenderString(markup.NewTestRenderContext(FullURL), input)
+		buffer, err := markdown.RenderString(markup.NewTestRenderContext(baseLink), input)
 		assert.NoError(t, err)
 		assert.Equal(t, strings.TrimSpace(expected), strings.TrimSpace(string(buffer)))
 	}
@@ -56,7 +55,7 @@ func TestRender_Images(t *testing.T) {
 	url := "../../.images/src/02/train.jpg"
 	title := "Train"
 	href := "https://gitea.io"
-	result := util.URLJoin(FullURL, url)
+	result := baseLink + "/.images/src/02/train.jpg" // resolved link should not go out of the base link
 	// hint: With Markdown v2.5.2, there is a new syntax: [link](URL){:target="_blank"} , but we do not support it now
 
 	render(
@@ -88,6 +87,8 @@ func TestRender_Images(t *testing.T) {
 }
 
 func TestTotal_RenderString(t *testing.T) {
+	const FullURL = AppURL + testRepoOwnerName + "/" + testRepoName + "/"
+	setting.AppURL = AppURL
 	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 
 	// Test cases without ambiguous links (It is not right to copy a whole file here, instead it should clearly test what is being tested)
@@ -258,7 +259,7 @@ This PR has been generated by [Renovate Bot](https://github.com/renovatebot/reno
 		},
 	})
 	for i := range sameCases {
-		line, err := markdown.RenderString(markup.NewTestRenderContext(localMetas), sameCases[i])
+		line, err := markdown.RenderString(markup.NewTestRenderContext(localMetas).WithEnableHeadingIDGeneration(true), sameCases[i])
 		assert.NoError(t, err)
 		assert.Equal(t, testAnswers[i], string(line))
 	}
@@ -428,9 +429,12 @@ test
 ---
 test
 `,
-			`- item1
-- item2
-
+			`<hr/>
+<ul>
+<li>item1</li>
+<li>item2</li>
+</ul>
+<hr/>
 <p>test</p>
 `,
 		},
@@ -442,8 +446,8 @@ anything
 ---
 test
 `,
-			`anything
-
+			`<hr/>
+<h2>anything</h2>
 <p>test</p>
 `,
 		},
@@ -470,18 +474,33 @@ foo: bar
 </details><ul>
 <li class="task-list-item"><input type="checkbox" disabled="" data-source-position="19"/>task 1</li>
 </ul>
+`,
+		},
+		// we have our own frontmatter parser, don't need to use github.com/yuin/goldmark-meta
+		{
+			"InvalidFrontmatter",
+			`---
+foo
+`,
+			`<hr/>
+<p>foo</p>
 `,
 		},
 	}
 
-	for _, test := range testcases {
-		res, err := markdown.RenderString(markup.NewTestRenderContext(), test.input)
-		assert.NoError(t, err, "Unexpected error in testcase: %q", test.name)
-		assert.Equal(t, test.expected, string(res), "Unexpected result in testcase %q", test.name)
+	for _, tt := range testcases {
+		t.Run(tt.name, func(t *testing.T) {
+			res, err := markdown.RenderString(markup.NewTestRenderContext(), tt.input)
+			assert.NoError(t, err, "Unexpected error in testcase: %q", tt.name)
+			assert.Equal(t, tt.expected, string(res), "Unexpected result in testcase %q", tt.name)
+		})
 	}
 }
 
 func TestRenderLinks(t *testing.T) {
+	defer test.MockVariableValue(&setting.AppURL, AppURL)()
+	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
+
 	input := `  space @mention-user${SPACE}${SPACE}
 /just/a/path.bin
 https://example.com/file.bin
@@ -519,9 +538,9 @@ mail@domain.com
 <a href="https://example.com/image.jpg" target="_blank" rel="nofollow noopener"><img src="https://example.com/image.jpg" alt="remote image"/></a>
 <a href="/image.jpg" rel="nofollow"><img src="/image.jpg" title="local image" alt="local image"/></a>
 <a href="https://example.com/image.jpg" rel="nofollow"><img src="https://example.com/image.jpg" title="remote link" alt="remote link"/></a>
-<a href="https://example.com/user/repo/compare/88fc37a3c0a4dda553bdcfc80c178a58247f42fb...12fc37a3c0a4dda553bdcfc80c178a58247f42fb#hash" rel="nofollow"><code>88fc37a3c0...12fc37a3c0 (hash)</code></a>
+<a href="https://example.com/user/repo/compare/88fc37a3c0a4dda553bdcfc80c178a58247f42fb...12fc37a3c0a4dda553bdcfc80c178a58247f42fb#hash" rel="nofollow">https://example.com/user/repo/compare/88fc37a3c0a4dda553bdcfc80c178a58247f42fb...12fc37a3c0a4dda553bdcfc80c178a58247f42fb#hash</a>
 com 88fc37a3c0a4dda553bdcfc80c178a58247f42fb...12fc37a3c0a4dda553bdcfc80c178a58247f42fb pare
-<a href="https://example.com/user/repo/commit/88fc37a3c0a4dda553bdcfc80c178a58247f42fb" rel="nofollow"><code>88fc37a3c0</code></a>
+<a href="https://example.com/user/repo/commit/88fc37a3c0a4dda553bdcfc80c178a58247f42fb" rel="nofollow">https://example.com/user/repo/commit/88fc37a3c0a4dda553bdcfc80c178a58247f42fb</a>
 com 88fc37a3c0a4dda553bdcfc80c178a58247f42fb mit
 <span class="emoji" aria-label="thumbs up">👍</span>
 <a href="mailto:mail@domain.com" rel="nofollow">mail@domain.com</a>
@@ -529,10 +548,21 @@ com 88fc37a3c0a4dda553bdcfc80c178a58247f42fb mit
 #123
 space</p>
 `
-	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, true)()
 	result, err := markdown.RenderString(markup.NewTestRenderContext(localMetas), input)
 	assert.NoError(t, err)
 	assert.Equal(t, expected, string(result))
+
+	t.Run("LocalCommitAndCompare", func(t *testing.T) {
+		input := `http://localhost:3000/user/repo/commit/88fc37a3c0a4dda553bdcfc80c178a58247f42fb
+http://localhost:3000/user/repo/compare/88fc37a3c0a4dda553bdcfc80c178a58247f42fb...12fc37a3c0a4dda553bdcfc80c178a58247f42fb#hash`
+
+		expected := `<p><a href="http://localhost:3000/user/repo/commit/88fc37a3c0a4dda553bdcfc80c178a58247f42fb" rel="nofollow"><code>88fc37a3c0</code></a>
+<a href="http://localhost:3000/user/repo/compare/88fc37a3c0a4dda553bdcfc80c178a58247f42fb...12fc37a3c0a4dda553bdcfc80c178a58247f42fb#hash" rel="nofollow"><code>88fc37a3c0...12fc37a3c0 (hash)</code></a></p>
+`
+		result, err := markdown.RenderString(markup.NewTestRenderContext(localMetas), input)
+		assert.NoError(t, err)
+		assert.Equal(t, expected, string(result))
+	})
 }
 
 func TestMarkdownLink(t *testing.T) {
@@ -545,5 +575,28 @@ func TestMarkdownLink(t *testing.T) {
 	assert.Equal(t, `<p><a href="/base/foo" rel="nofollow">link1</a>
 <a href="/base/foo" rel="nofollow">link2</a>
 <a href="#user-content-foo" rel="nofollow">link3</a></p>
+`, string(result))
+
+	input = "https://example.com/__init__.py"
+	result, err = markdown.RenderString(markup.NewTestRenderContext("/base", localMetas), input)
+	assert.NoError(t, err)
+	assert.Equal(t, `<p><a href="https://example.com/__init__.py" rel="nofollow">https://example.com/__init__.py</a></p>
+`, string(result))
+}
+
+func TestMarkdownUlDir(t *testing.T) {
+	defer test.MockVariableValue(&markup.RenderBehaviorForTesting.DisableAdditionalAttributes, false)()
+	result, err := markdown.RenderString(markup.NewTestRenderContext(), `
+* a
+  * b
+`)
+	assert.NoError(t, err)
+	assert.Equal(t, `<ul dir="auto">
+<li>a
+<ul>
+<li>b</li>
+</ul>
+</li>
+</ul>
 `, string(result))
 }

package/gitea/source/modules/markup/markdown/meta.go

@@ -60,8 +60,8 @@ func ExtractMetadata(contents string, out any) (string, error) {
 	return string(body), err
 }
 
-// ExtractMetadata consumes a markdown file, parses YAML frontmatter,
-// and returns the frontmatter metadata separated from the markdown content
+// ExtractMetadataBytes consumes a Markdown content, parses YAML frontmatter,
+// and returns the frontmatter metadata separated from the Markdown content
 func ExtractMetadataBytes(contents []byte, out any) ([]byte, error) {
 	var front, body []byte
 

package/gitea/source/modules/markup/markdown/prefixed_id.go

@@ -1,59 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package markdown
-
-import (
-	"bytes"
-	"fmt"
-
-	"code.gitea.io/gitea/modules/container"
-	"code.gitea.io/gitea/modules/markup/common"
-	"code.gitea.io/gitea/modules/util"
-
-	"github.com/yuin/goldmark/ast"
-)
-
-type prefixedIDs struct {
-	values container.Set[string]
-}
-
-// Generate generates a new element id.
-func (p *prefixedIDs) Generate(value []byte, kind ast.NodeKind) []byte {
-	dft := []byte("id")
-	if kind == ast.KindHeading {
-		dft = []byte("heading")
-	}
-	return p.GenerateWithDefault(value, dft)
-}
-
-// GenerateWithDefault generates a new element id.
-func (p *prefixedIDs) GenerateWithDefault(value, dft []byte) []byte {
-	result := common.CleanValue(value)
-	if len(result) == 0 {
-		result = dft
-	}
-	if !bytes.HasPrefix(result, []byte("user-content-")) {
-		result = append([]byte("user-content-"), result...)
-	}
-	if p.values.Add(util.UnsafeBytesToString(result)) {
-		return result
-	}
-	for i := 1; ; i++ {
-		newResult := fmt.Sprintf("%s-%d", result, i)
-		if p.values.Add(newResult) {
-			return []byte(newResult)
-		}
-	}
-}
-
-// Put puts a given element id to the used ids table.
-func (p *prefixedIDs) Put(value []byte) {
-	p.values.Add(util.UnsafeBytesToString(value))
-}
-
-func newPrefixedIDs() *prefixedIDs {
-	return &prefixedIDs{
-		values: make(container.Set[string]),
-	}
-}

package/gitea/source/modules/markup/markdown/toc.go

@@ -1,59 +0,0 @@
-// Copyright 2020 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package markdown
-
-import (
-	"net/url"
-
-	"code.gitea.io/gitea/modules/translation"
-
-	"github.com/yuin/goldmark/ast"
-)
-
-// Header holds the data about a header.
-type Header struct {
-	Level int
-	Text  string
-	ID    string
-}
-
-func createTOCNode(toc []Header, lang string, detailsAttrs map[string]string) ast.Node {
-	details := NewDetails()
-	summary := NewSummary()
-
-	for k, v := range detailsAttrs {
-		details.SetAttributeString(k, []byte(v))
-	}
-
-	summary.AppendChild(summary, ast.NewString([]byte(translation.NewLocale(lang).TrString("toc"))))
-	details.AppendChild(details, summary)
-	ul := ast.NewList('-')
-	details.AppendChild(details, ul)
-	currentLevel := 6
-	for _, header := range toc {
-		if header.Level < currentLevel {
-			currentLevel = header.Level
-		}
-	}
-	for _, header := range toc {
-		for currentLevel > header.Level {
-			ul = ul.Parent().(*ast.List)
-			currentLevel--
-		}
-		for currentLevel < header.Level {
-			newL := ast.NewList('-')
-			ul.AppendChild(ul, newL)
-			currentLevel++
-			ul = newL
-		}
-		li := ast.NewListItem(currentLevel * 2)
-		a := ast.NewLink()
-		a.Destination = []byte("#" + url.QueryEscape(header.ID))
-		a.AppendChild(a, ast.NewString([]byte(header.Text)))
-		li.AppendChild(li, a)
-		ul.AppendChild(ul, li)
-	}
-
-	return details
-}

package/gitea/source/modules/markup/markdown/transform_heading.go

@@ -1,32 +0,0 @@
-// Copyright 2024 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package markdown
-
-import (
-	"fmt"
-
-	"code.gitea.io/gitea/modules/markup"
-	"code.gitea.io/gitea/modules/util"
-
-	"github.com/yuin/goldmark/ast"
-	"github.com/yuin/goldmark/text"
-)
-
-func (g *ASTTransformer) transformHeading(_ *markup.RenderContext, v *ast.Heading, reader text.Reader, tocList *[]Header) {
-	for _, attr := range v.Attributes() {
-		if _, ok := attr.Value.([]byte); !ok {
-			v.SetAttribute(attr.Name, fmt.Appendf(nil, "%v", attr.Value))
-		}
-	}
-	txt := v.Text(reader.Source()) //nolint:staticcheck // Text is deprecated
-	header := Header{
-		Text:  util.UnsafeBytesToString(txt),
-		Level: v.Level,
-	}
-	if id, found := v.AttributeString("id"); found {
-		header.ID = util.UnsafeBytesToString(id.([]byte))
-	}
-	*tocList = append(*tocList, header)
-	g.applyElementDir(v)
-}

package/gitea/source/modules/markup/markdown/transform_list.go

@@ -81,5 +81,16 @@ func (g *ASTTransformer) transformList(_ *markup.RenderContext, v *ast.List, rc
 			v.AppendChild(v, newChild)
 		}
 	}
-	g.applyElementDir(v)
+
+	nestedList := false
+	for p := v.Parent(); p != nil; p = p.Parent() {
+		if _, ok := p.(*ast.List); ok {
+			nestedList = true
+			break
+		}
+	}
+	if !nestedList {
+		// "dir=auto" should be only added to top-level "ul". https://github.com/go-gitea/gitea/issues/35058
+		g.applyElementDir(v)
+	}
 }

package/gitea/source/modules/markup/mdstripper/mdstripper.go

@@ -46,7 +46,7 @@ func (r *stripRenderer) Render(w io.Writer, source []byte, doc ast.Node) error {
 				coalesce := prevSibIsText
 				r.processString(
 					w,
-					v.Text(source), //nolint:staticcheck // Text is deprecated
+					v.Value(source),
 					coalesce)
 				if v.SoftLineBreak() {
 					r.doubleSpace(w)
@@ -165,7 +165,6 @@ func StripMarkdownBytes(rawBytes []byte) ([]byte, []string) {
 			),
 			goldmark.WithParserOptions(
 				parser.WithAttribute(),
-				parser.WithAutoHeadingID(),
 			),
 			goldmark.WithRendererOptions(
 				html.WithUnsafe(),

package/gitea/source/modules/markup/orgmode/orgmode.go

@@ -5,7 +5,6 @@ package orgmode
 
 import (
 	"fmt"
-	"html"
 	"html/template"
 	"io"
 	"strings"
@@ -17,7 +16,6 @@ import (
 	"code.gitea.io/gitea/modules/setting"
 
 	"github.com/alecthomas/chroma/v2"
-	"github.com/alecthomas/chroma/v2/lexers"
 	"github.com/niklasfasching/go-org/org"
 )
 
@@ -33,20 +31,16 @@ var (
 	_ markup.PostProcessRenderer = (*renderer)(nil)
 )
 
-// Name implements markup.Renderer
 func (renderer) Name() string {
 	return "orgmode"
 }
 
-// NeedPostProcess implements markup.PostProcessRenderer
 func (renderer) NeedPostProcess() bool { return true }
 
-// Extensions implements markup.Renderer
-func (renderer) Extensions() []string {
-	return []string{".org"}
+func (renderer) FileNamePatterns() []string {
+	return []string{"*.org"}
 }
 
-// SanitizerRules implements markup.Renderer
 func (renderer) SanitizerRules() []setting.MarkupSanitizerRule {
 	return []setting.MarkupSanitizerRule{}
 }
@@ -57,40 +51,20 @@ func Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error
 	htmlWriter.HighlightCodeBlock = func(source, lang string, inline bool, params map[string]string) string {
 		defer func() {
 			if err := recover(); err != nil {
+				// catch the panic, log the error and return empty result
 				log.Error("Panic in HighlightCodeBlock: %v\n%s", err, log.Stack(2))
-				panic(err)
 			}
 		}()
-		w := &strings.Builder{}
 
-		lexer := lexers.Get(lang)
-		if lexer == nil && lang == "" {
-			lexer = lexers.Analyse(source)
-			if lexer == nil {
-				lexer = lexers.Fallback
-			}
-			lang = strings.ToLower(lexer.Config().Name)
-		}
+		lexer := highlight.DetectChromaLexerByFileName("", lang) // don't use content to detect, it is too slow
+		lexer = chroma.Coalesce(lexer)
 
+		sb := &strings.Builder{}
 		// include language-x class as part of commonmark spec
-		if err := ctx.RenderInternal.FormatWithSafeAttrs(w, `<pre><code class="chroma language-%s">`, lang); err != nil {
-			return ""
-		}
-		if lexer == nil {
-			if _, err := w.WriteString(html.EscapeString(source)); err != nil {
-				return ""
-			}
-		} else {
-			lexer = chroma.Coalesce(lexer)
-			if _, err := w.WriteString(string(highlight.CodeFromLexer(lexer, source))); err != nil {
-				return ""
-			}
-		}
-		if _, err := w.WriteString("</code></pre>"); err != nil {
-			return ""
-		}
-
-		return w.String()
+		_ = ctx.RenderInternal.FormatWithSafeAttrs(sb, `<pre><code class="chroma language-%s">`, strings.ToLower(lexer.Config().Name))
+		_, _ = sb.WriteString(string(highlight.RenderCodeByLexer(lexer, source)))
+		_, _ = sb.WriteString("</code></pre>")
+		return sb.String()
 	}
 
 	w := &orgWriter{rctx: ctx, HTMLWriter: htmlWriter}

package/gitea/source/modules/markup/render.go

@@ -4,7 +4,9 @@
 package markup
 
 import (
+	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"html/template"
 	"io"
@@ -15,10 +17,11 @@ import (
 
 	"code.gitea.io/gitea/modules/htmlutil"
 	"code.gitea.io/gitea/modules/markup/internal"
+	"code.gitea.io/gitea/modules/public"
 	"code.gitea.io/gitea/modules/setting"
+	"code.gitea.io/gitea/modules/typesniffer"
 	"code.gitea.io/gitea/modules/util"
 
-	"github.com/yuin/goldmark/ast"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -36,6 +39,15 @@ var RenderBehaviorForTesting struct {
 	DisableAdditionalAttributes bool
 }
 
+type WebThemeInterface interface {
+	PublicAssetURI() string
+}
+
+type StandalonePageOptions struct {
+	CurrentWebTheme   WebThemeInterface
+	RenderQueryString string
+}
+
 type RenderOptions struct {
 	UseAbsoluteLink bool
 
@@ -53,7 +65,24 @@ type RenderOptions struct {
 	Metas map[string]string
 
 	// used by external render. the router "/org/repo/render/..." will output the rendered content in a standalone page
-	InStandalonePage bool
+	StandalonePageOptions *StandalonePageOptions
+
+	// EnableHeadingIDGeneration controls whether to auto-generate IDs for HTML headings without id attribute.
+	// This should be enabled for repository files and wiki pages, but disabled for comments to avoid duplicate IDs.
+	EnableHeadingIDGeneration bool
+}
+
+type TocShowInSectionType string
+
+const (
+	TocShowInSidebar TocShowInSectionType = "sidebar"
+	TocShowInMain    TocShowInSectionType = "main"
+)
+
+type TocHeadingItem struct {
+	HeadingLevel int
+	AnchorID     string
+	InnerText    string
 }
 
 // RenderContext represents a render context
@@ -63,7 +92,8 @@ type RenderContext struct {
 	// the context might be used by the "render" function, but it might also be used by "postProcess" function
 	usedByRender bool
 
-	SidebarTocNode ast.Node
+	TocShowInSection TocShowInSectionType
+	TocHeadingItems  []*TocHeadingItem
 
 	RenderHelper   RenderHelper
 	RenderOptions  RenderOptions
@@ -107,8 +137,13 @@ func (ctx *RenderContext) WithMetas(metas map[string]string) *RenderContext {
 	return ctx
 }
 
-func (ctx *RenderContext) WithInStandalonePage(v bool) *RenderContext {
-	ctx.RenderOptions.InStandalonePage = v
+func (ctx *RenderContext) WithStandalonePage(opts StandalonePageOptions) *RenderContext {
+	ctx.RenderOptions.StandalonePageOptions = &opts
+	return ctx
+}
+
+func (ctx *RenderContext) WithEnableHeadingIDGeneration(v bool) *RenderContext {
+	ctx.RenderOptions.EnableHeadingIDGeneration = v
 	return ctx
 }
 
@@ -122,22 +157,29 @@ func (ctx *RenderContext) WithHelper(helper RenderHelper) *RenderContext {
 	return ctx
 }
 
-// FindRendererByContext finds renderer by RenderContext
-// TODO: it should be merged with other similar functions like GetRendererByFileName, DetectMarkupTypeByFileName, etc
-func FindRendererByContext(ctx *RenderContext) (Renderer, error) {
+func (ctx *RenderContext) DetectMarkupRenderer(prefetchBuf []byte) Renderer {
 	if ctx.RenderOptions.MarkupType == "" && ctx.RenderOptions.RelativePath != "" {
-		ctx.RenderOptions.MarkupType = DetectMarkupTypeByFileName(ctx.RenderOptions.RelativePath)
-		if ctx.RenderOptions.MarkupType == "" {
-			return nil, util.NewInvalidArgumentErrorf("unsupported file to render: %q", ctx.RenderOptions.RelativePath)
+		var sniffedType typesniffer.SniffedType
+		if len(prefetchBuf) > 0 {
+			sniffedType = typesniffer.DetectContentType(prefetchBuf)
 		}
+		ctx.RenderOptions.MarkupType = DetectRendererTypeByPrefetch(ctx.RenderOptions.RelativePath, sniffedType, prefetchBuf)
 	}
+	return renderers[ctx.RenderOptions.MarkupType]
+}
 
-	renderer := renderers[ctx.RenderOptions.MarkupType]
+func (ctx *RenderContext) DetectMarkupRendererByReader(in io.Reader) (Renderer, io.Reader, error) {
+	prefetchBuf := make([]byte, 512)
+	n, err := util.ReadAtMost(in, prefetchBuf)
+	if err != nil && err != io.EOF {
+		return nil, nil, err
+	}
+	prefetchBuf = prefetchBuf[:n]
+	renderer := ctx.DetectMarkupRenderer(prefetchBuf)
 	if renderer == nil {
-		return nil, util.NewNotExistErrorf("unsupported markup type: %q", ctx.RenderOptions.MarkupType)
+		return nil, nil, util.NewInvalidArgumentErrorf("unable to find a render")
 	}
-
-	return renderer, nil
+	return renderer, io.MultiReader(bytes.NewReader(prefetchBuf), in), nil
 }
 
 func RendererNeedPostProcess(renderer Renderer) bool {
@@ -148,12 +190,12 @@ func RendererNeedPostProcess(renderer Renderer) bool {
 }
 
 // Render renders markup file to HTML with all specific handling stuff.
-func Render(ctx *RenderContext, input io.Reader, output io.Writer) error {
-	renderer, err := FindRendererByContext(ctx)
+func Render(rctx *RenderContext, origInput io.Reader, output io.Writer) error {
+	renderer, input, err := rctx.DetectMarkupRendererByReader(origInput)
 	if err != nil {
 		return err
 	}
-	return RenderWithRenderer(ctx, renderer, input, output)
+	return RenderWithRenderer(rctx, renderer, input, output)
 }
 
 // RenderString renders Markup string to HTML with all specific handling stuff and return string
@@ -165,20 +207,24 @@ func RenderString(ctx *RenderContext, content string) (string, error) {
 	return buf.String(), nil
 }
 
-func renderIFrame(ctx *RenderContext, sandbox string, output io.Writer) error {
+func RenderIFrame(ctx *RenderContext, opts *ExternalRendererOptions, output io.Writer) error {
+	ownerName, repoName := ctx.RenderOptions.Metas["user"], ctx.RenderOptions.Metas["repo"]
+	refSubURL := ctx.RenderOptions.Metas["RefTypeNameSubURL"]
+	if ownerName == "" || repoName == "" || refSubURL == "" {
+		setting.PanicInDevOrTesting("RenderIFrame requires user, repo and RefTypeNameSubURL metas")
+		return errors.New("RenderIFrame requires user, repo and RefTypeNameSubURL metas")
+	}
 	src := fmt.Sprintf("%s/%s/%s/render/%s/%s", setting.AppSubURL,
-		url.PathEscape(ctx.RenderOptions.Metas["user"]),
-		url.PathEscape(ctx.RenderOptions.Metas["repo"]),
-		util.PathEscapeSegments(ctx.RenderOptions.Metas["RefTypeNameSubURL"]),
+		url.PathEscape(ownerName),
+		url.PathEscape(repoName),
+		ctx.RenderOptions.Metas["RefTypeNameSubURL"],
 		util.PathEscapeSegments(ctx.RenderOptions.RelativePath),
 	)
-
-	var sandboxAttrValue template.HTML
-	if sandbox != "" {
-		sandboxAttrValue = htmlutil.HTMLFormat(`sandbox="%s"`, sandbox)
+	var extraAttrs template.HTML
+	if opts.ContentSandbox != "" {
+		extraAttrs = htmlutil.HTMLFormat(` sandbox="%s"`, opts.ContentSandbox)
 	}
-	iframe := htmlutil.HTMLFormat(`<iframe data-src="%s" class="external-render-iframe" %s></iframe>`, src, sandboxAttrValue)
-	_, err := io.WriteString(output, string(iframe))
+	_, err := htmlutil.HTMLPrintf(output, `<iframe data-src="%s" data-global-init="initExternalRenderIframe" class="external-render-iframe"%s></iframe>`, src, extraAttrs)
 	return err
 }
 
@@ -190,7 +236,7 @@ func pipes() (io.ReadCloser, io.WriteCloser, func()) {
 	}
 }
 
-func getExternalRendererOptions(renderer Renderer) (ret ExternalRendererOptions, _ bool) {
+func GetExternalRendererOptions(renderer Renderer) (ret ExternalRendererOptions, _ bool) {
 	if externalRender, ok := renderer.(ExternalRenderer); ok {
 		return externalRender.GetExternalRendererOptions(), true
 	}
@@ -199,17 +245,23 @@ func getExternalRendererOptions(renderer Renderer) (ret ExternalRendererOptions,
 
 func RenderWithRenderer(ctx *RenderContext, renderer Renderer, input io.Reader, output io.Writer) error {
 	var extraHeadHTML template.HTML
-	if extOpts, ok := getExternalRendererOptions(renderer); ok && extOpts.DisplayInIframe {
-		if !ctx.RenderOptions.InStandalonePage {
+	if extOpts, ok := GetExternalRendererOptions(renderer); ok && extOpts.DisplayInIframe {
+		if ctx.RenderOptions.StandalonePageOptions == nil {
 			// for an external "DisplayInIFrame" render, it could only output its content in a standalone page
 			// otherwise, a <iframe> should be outputted to embed the external rendered page
-			return renderIFrame(ctx, extOpts.ContentSandbox, output)
+			return RenderIFrame(ctx, &extOpts, output)
 		}
 		// else: this is a standalone page, fallthrough to the real rendering, and add extra JS/CSS
-		extraStyleHref := setting.AppSubURL + "/assets/css/external-render-iframe.css"
-		extraScriptSrc := setting.AppSubURL + "/assets/js/external-render-iframe.js"
+		extraScriptSrc := public.AssetURI("js/external-render-helper.js")
+		extraLinkHref := ctx.RenderOptions.StandalonePageOptions.CurrentWebTheme.PublicAssetURI()
 		// "<script>" must go before "<link>", to make Golang's http.DetectContentType() can still recognize the content as "text/html"
-		extraHeadHTML = htmlutil.HTMLFormat(`<script src="%s"></script><link rel="stylesheet" href="%s">`, extraScriptSrc, extraStyleHref)
+		// DO NOT use "type=module", the script must run as early as possible, to set up the environment in the iframe
+		extraHeadHTML = htmlutil.HTMLFormat(
+			`<script nonce crossorigin src="%s" id="gitea-external-render-helper" data-render-query-string="%s"></script>`+
+				`<link rel="stylesheet" href="%s">`,
+			extraScriptSrc, ctx.RenderOptions.StandalonePageOptions.RenderQueryString,
+			extraLinkHref,
+		)
 	}
 
 	ctx.usedByRender = true
@@ -265,12 +317,14 @@ func Init(renderHelpFuncs *RenderHelperFuncs) {
 	}
 
 	// since setting maybe changed extensions, this will reload all renderer extensions mapping
-	extRenderers = make(map[string]Renderer)
+	fileNameRenderers = make(map[string]Renderer)
 	for _, renderer := range renderers {
-		for _, ext := range renderer.Extensions() {
-			extRenderers[strings.ToLower(ext)] = renderer
+		for _, pattern := range renderer.FileNamePatterns() {
+			fileNameRenderers[pattern] = renderer
 		}
 	}
+
+	RefreshFileNamePatterns()
 }
 
 func ComposeSimpleDocumentMetas() map[string]string {

package/gitea/source/modules/markup/render_link.go

@@ -5,28 +5,47 @@ package markup
 
 import (
 	"context"
+	"net/url"
+	"path"
 	"strings"
 
 	"code.gitea.io/gitea/modules/httplib"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
 )
 
+// resolveLinkRelative tries to resolve the link relative to the "{base}/{cur}", and returns the final link.
+// It only resolves the link, doesn't do any sanitization or validation, invalid links will be returned as is.
 func resolveLinkRelative(ctx context.Context, base, cur, link string, absolute bool) (finalLink string) {
-	if IsFullURLString(link) {
-		return link
+	linkURL, err := url.Parse(link)
+	if err != nil {
+		return link // invalid URL, return as is
 	}
+	if linkURL.Scheme != "" || linkURL.Host != "" {
+		return link // absolute URL, return as is
+	}
+
 	if strings.HasPrefix(link, "/") {
 		if strings.HasPrefix(link, base) && strings.Count(base, "/") >= 4 {
-			// a trick to tolerate that some users were using absolute paths (the old gitea's behavior)
+			// a trick to tolerate that some users were using absolute paths (the old Gitea's behavior)
+			// if the link is likely "{base}/src/main" while "{base}" is something like "/owner/repo"
 			finalLink = link
 		} else {
-			finalLink = util.URLJoin(base, "./", link)
+			// need to resolve the link relative to "{base}"
+			cur = ""
+		}
+	} // else: link is relative to "{base}/{cur}"
+
+	if finalLink == "" {
+		finalLink = strings.TrimSuffix(base, "/") + path.Join("/"+cur, "/"+linkURL.EscapedPath())
+		finalLink = strings.TrimSuffix(finalLink, "/")
+		if linkURL.RawQuery != "" {
+			finalLink += "?" + linkURL.RawQuery
+		}
+		if linkURL.Fragment != "" {
+			finalLink += "#" + linkURL.Fragment
 		}
-	} else {
-		finalLink = util.URLJoin(base, "./", cur, link)
 	}
-	finalLink = strings.TrimSuffix(finalLink, "/")
+
 	if absolute {
 		finalLink = httplib.MakeAbsoluteURL(ctx, finalLink)
 	}

package/gitea/source/modules/markup/render_link_test.go

@@ -18,8 +18,16 @@ func TestResolveLinkRelative(t *testing.T) {
 	assert.Equal(t, "/a/b", resolveLinkRelative(ctx, "/a", "b", "", false))
 	assert.Equal(t, "/a/b/c", resolveLinkRelative(ctx, "/a", "b", "c", false))
 	assert.Equal(t, "/a/c", resolveLinkRelative(ctx, "/a", "b", "/c", false))
+	assert.Equal(t, "/a/c#id", resolveLinkRelative(ctx, "/a", "b", "/c#id", false))
+	assert.Equal(t, "/a/%2f?k=/", resolveLinkRelative(ctx, "/a", "b", "/%2f/?k=/", false))
+	assert.Equal(t, "/a/b/c?k=v#id", resolveLinkRelative(ctx, "/a", "b", "c/?k=v#id", false))
+	assert.Equal(t, "%invalid", resolveLinkRelative(ctx, "/a", "b", "%invalid", false))
 	assert.Equal(t, "http://localhost:3000/a", resolveLinkRelative(ctx, "/a", "", "", true))
 
+	// absolute link is returned as is
+	assert.Equal(t, "mailto:user@domain.com", resolveLinkRelative(ctx, "/a", "", "mailto:user@domain.com", false))
+	assert.Equal(t, "http://other/path/", resolveLinkRelative(ctx, "/a", "", "http://other/path/", false))
+
 	// some users might have used absolute paths a lot, so if the prefix overlaps and has enough slashes, we should tolerate it
 	assert.Equal(t, "/owner/repo/foo/owner/repo/foo/bar/xxx", resolveLinkRelative(ctx, "/owner/repo/foo", "", "/owner/repo/foo/bar/xxx", false))
 	assert.Equal(t, "/owner/repo/foo/bar/xxx", resolveLinkRelative(ctx, "/owner/repo/foo/bar", "", "/owner/repo/foo/bar/xxx", false))

package/gitea/source/modules/markup/render_test.go

@@ -0,0 +1,31 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package markup
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRenderIFrame(t *testing.T) {
+	render := func(ctx *RenderContext, opts ExternalRendererOptions) string {
+		sb := &strings.Builder{}
+		require.NoError(t, RenderIFrame(ctx, &opts, sb))
+		return sb.String()
+	}
+
+	ctx := NewRenderContext(t.Context()).
+		WithRelativePath("tree-path").
+		WithMetas(map[string]string{"user": "test-owner", "repo": "test-repo", "RefTypeNameSubURL": "src/branch/master"})
+
+	// the value is read from config RENDER_CONTENT_SANDBOX, empty means "disabled"
+	ret := render(ctx, ExternalRendererOptions{ContentSandbox: ""})
+	assert.Equal(t, `<iframe data-src="/test-owner/test-repo/render/src/branch/master/tree-path" data-global-init="initExternalRenderIframe" class="external-render-iframe"></iframe>`, ret)
+
+	ret = render(ctx, ExternalRendererOptions{ContentSandbox: "allow"})
+	assert.Equal(t, `<iframe data-src="/test-owner/test-repo/render/src/branch/master/tree-path" data-global-init="initExternalRenderIframe" class="external-render-iframe" sandbox="allow"></iframe>`, ret)
+}

package/gitea/source/modules/markup/renderer.go

@@ -14,8 +14,8 @@ import (
 
 // Renderer defines an interface for rendering markup file to HTML
 type Renderer interface {
-	Name() string // markup format name
-	Extensions() []string
+	Name() string // markup format name, also the renderer type, also the external tool name
+	FileNamePatterns() []string
 	SanitizerRules() []setting.MarkupSanitizerRule
 	Render(ctx *RenderContext, input io.Reader, output io.Writer) error
 }
@@ -43,26 +43,52 @@ type RendererContentDetector interface {
 }
 
 var (
-	extRenderers = make(map[string]Renderer)
-	renderers    = make(map[string]Renderer)
+	fileNameRenderers = make(map[string]Renderer)
+	renderers         = make(map[string]Renderer)
 )
 
 // RegisterRenderer registers a new markup file renderer
 func RegisterRenderer(renderer Renderer) {
+	// TODO: need to handle conflicts
 	renderers[renderer.Name()] = renderer
-	for _, ext := range renderer.Extensions() {
-		extRenderers[strings.ToLower(ext)] = renderer
+}
+
+func RefreshFileNamePatterns() {
+	// TODO: need to handle conflicts
+	fileNameRenderers = make(map[string]Renderer)
+	for _, renderer := range renderers {
+		for _, ext := range renderer.FileNamePatterns() {
+			fileNameRenderers[strings.ToLower(ext)] = renderer
+		}
 	}
 }
 
-// GetRendererByFileName get renderer by filename
-func GetRendererByFileName(filename string) Renderer {
-	extension := strings.ToLower(path.Ext(filename))
-	return extRenderers[extension]
+func DetectRendererTypeByFilename(filename string) Renderer {
+	basename := path.Base(strings.ToLower(filename))
+	ext1 := path.Ext(basename)
+	if renderer := fileNameRenderers[basename]; renderer != nil {
+		return renderer
+	}
+	if renderer := fileNameRenderers["*"+ext1]; renderer != nil {
+		return renderer
+	}
+	if basename, ok := strings.CutSuffix(basename, ext1); ok {
+		ext2 := path.Ext(basename)
+		if renderer := fileNameRenderers["*"+ext2+ext1]; renderer != nil {
+			return renderer
+		}
+	}
+	return nil
 }
 
-// DetectRendererType detects the markup type of the content
-func DetectRendererType(filename string, sniffedType typesniffer.SniffedType, prefetchBuf []byte) string {
+// DetectRendererTypeByPrefetch detects the markup type of the content
+func DetectRendererTypeByPrefetch(filename string, sniffedType typesniffer.SniffedType, prefetchBuf []byte) string {
+	if filename != "" {
+		byExt := DetectRendererTypeByFilename(filename)
+		if byExt != nil {
+			return byExt.Name()
+		}
+	}
 	for _, renderer := range renderers {
 		if detector, ok := renderer.(RendererContentDetector); ok && detector.CanRender(filename, sniffedType, prefetchBuf) {
 			return renderer.Name()
@@ -71,18 +97,12 @@ func DetectRendererType(filename string, sniffedType typesniffer.SniffedType, pr
 	return ""
 }
 
-// DetectMarkupTypeByFileName returns the possible markup format type via the filename
-func DetectMarkupTypeByFileName(filename string) string {
-	if parser := GetRendererByFileName(filename); parser != nil {
-		return parser.Name()
-	}
-	return ""
-}
-
 func PreviewableExtensions() []string {
-	extensions := make([]string, 0, len(extRenderers))
-	for extension := range extRenderers {
-		extensions = append(extensions, extension)
+	exts := make([]string, 0, len(fileNameRenderers))
+	for p := range fileNameRenderers {
+		if s, ok := strings.CutPrefix(p, "*"); ok {
+			exts = append(exts, s)
+		}
 	}
-	return extensions
+	return exts
 }

package/gitea/source/modules/markup/sanitizer_default.go

@@ -56,6 +56,11 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 
 	policy.AllowAttrs("src", "autoplay", "controls").OnElements("video")
 
+	// Native support of "<picture><source media=... srcset=...><img src=...></picture>"
+	// ATTENTION: it only works with "auto" theme, because "media" query doesn't work with the theme chosen by end user manually.
+	// For example: browser's color scheme is "dark", but end user chooses "light" theme. Maybe it needs JS to help to make it work.
+	policy.AllowAttrs("media", "srcset").OnElements("source")
+
 	policy.AllowAttrs("loading").OnElements("img")
 
 	// Allow generally safe attributes (reference: https://github.com/jch/html-pipeline)
@@ -81,11 +86,12 @@ func (st *Sanitizer) createDefaultPolicy() *bluemonday.Policy {
 		"data-markdown-generated-content", "data-attr-class",
 	}
 	generalSafeElements := []string{
-		"h1", "h2", "h3", "h4", "h5", "h6", "h7", "h8", "br", "b", "i", "strong", "em", "a", "pre", "code", "img", "tt",
+		"h1", "h2", "h3", "h4", "h5", "h6", "h7", "h8", "br", "b", "center", "i", "strong", "em", "a", "pre", "code", "img", "tt",
 		"div", "ins", "del", "sup", "sub", "p", "ol", "ul", "table", "thead", "tbody", "tfoot", "blockquote", "label",
 		"dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td", "th", "s", "strike", "summary",
 		"details", "caption", "figure", "figcaption",
 		"abbr", "bdo", "cite", "dfn", "mark", "small", "span", "time", "video", "wbr",
+		"picture", "source",
 	}
 	// FIXME: Need to handle longdesc in img but there is no easy way to do it
 	policy.AllowAttrs(generalSafeAttrs...).OnElements(generalSafeElements...)

package/gitea/source/modules/markup/sanitizer_default_test.go

@@ -58,6 +58,9 @@ func TestSanitizer(t *testing.T) {
 		`<a href="cbthunderlink://somebase64string)">my custom URL scheme</a>`, `<a href="cbthunderlink://somebase64string)" rel="nofollow">my custom URL scheme</a>`,
 		`<a href="matrix:roomid/psumPMeAfzgAeQpXMG:feneas.org?action=join">my custom URL scheme</a>`, `<a href="matrix:roomid/psumPMeAfzgAeQpXMG:feneas.org?action=join" rel="nofollow">my custom URL scheme</a>`,
 
+		// picture
+		`<picture><source media="a"><source media="b"><img alt="c" src="d"></picture>`, `<picture><source media="a"><source media="b"><img alt="c" src="d"></picture>`,
+
 		// Disallow dangerous url schemes
 		`<a href="javascript:alert('xss')">bad</a>`, `bad`,
 		`<a href="vbscript:no">bad</a>`, `bad`,

package/gitea/source/modules/markup/sanitizer_description_test.go

@@ -16,7 +16,7 @@ func TestDescriptionSanitizer(t *testing.T) {
 		`<span class="emoji" aria-label="thumbs up">THUMBS UP</span>`, `<span class="emoji" aria-label="thumbs up">THUMBS UP</span>`,
 		`<span style="color: red">Hello World</span>`, `<span>Hello World</span>`,
 		`<br>`, ``,
-		`<a href="https://example.com" target="_blank" rel="noopener noreferrer">https://example.com</a>`, `<a href="https://example.com" target="_blank" rel="noopener noreferrer nofollow">https://example.com</a>`,
+		`<a href="https://example.com" target="_blank">https://example.com</a>`, `<a href="https://example.com" target="_blank" rel="nofollow noopener">https://example.com</a>`,
 		`<a href="data:1234">data</a>`, `data`,
 		`<mark>Important!</mark>`, `Important!`,
 		`<details>Click me! <summary>Nothing to see here.</summary></details>`, `Click me! Nothing to see here.`,