Live data from Hacker News

Include diagrams in your Markdown files with Mermaid

github.blog

161–170 of 272 posts

Re: Include diagrams in your Markdown files with Mermaid

#161

Protip to anyone using Mermaid.js Don't. It's a sea shanty of XSS vulns. https://snyk.io/vuln/npm%3Amermaid

I don't quite understand. Does XSS mean it runs user submitted js code?

I thought it would have a parser that parses the submitted code to generate its own graph representation. there shouldn't be a chance for running js, no?

Re: Include diagrams in your Markdown files with Mermaid

#162

I think so-called ASCII-art is more in the spirit of Markdown. The nice thing about the original Markdown (modulo bugs) is that things are written the way one would write plaintext documents which are supposed to be easily read in a text editor. So you don’t write bullet lists like this: - Bullet 1 - Bullet 2 - Bullet 3 And hope that some post-processing will add linebreaks for you. You write it like this: - Bullet 1…

If I need something to look good as text without any rendering I write text (a .txt file). Even the most basic features of markdown (inline code, italics, etc) look pretty nasty without post rendering.

I strongly disagree with that, they're about as clear and unintrusive as I can imagine, what else would you do?

Personally _I_ even sometimes use them when markdown isn't available, as in won't be rendered.

Re: Include diagrams in your Markdown files with Mermaid

#163
post #43

I think so-called ASCII-art is more in the spirit of Markdown. The nice thing about the original Markdown (modulo bugs) is that things are written the way one would write plaintext documents which are supposed to be easily read in a text editor. So you don’t write bullet lists like this: - Bullet 1 - Bullet 2 - Bullet 3 And hope that some post-processing will add linebreaks for you. You write it like this: - Bullet 1…

The "spirit of markdown" has long been abandoned by GitHub, more often than not the offline readability of a README is absolutely ignored in exchange for a safe-HTML subset to create kind-of websites below the directory listing of a repository. It should really be called RENDERME.

README.HTML

Re: Include diagrams in your Markdown files with Mermaid

#167
post #77

Earlier quoted context omitted.

There's no hard dependency at all. The markdown will parse just fine without mermaid.js, it basically just takes a code block and runs it through the mermaid.js code if it matches the language

I'm not talking about a dependency for the file to be readable. I'm talking about a dependency for the diagram to be useful. I'm not opposed to extending markdown, but most functionality like this seems to involve bolting on external dependencies to take advantage of it.

So you want every markdown parser to support building diagrams as well? That seems much more difficult than offloading it to an open source library. Why waste effort that already has gone into building an easy to read diagraming language?

Re: Include diagrams in your Markdown files with Mermaid

#168
post #9

I’m super excited for this! One thought though, on the syntax. Wouldn’t it be a bit odd if suddenly this line in a README.md: ```js const foo = 1 + 1 ``` Rendered as: `2` ? Isn’t that kind of what we’re doing here with the mermaid source tag? That tag is for showing source code, no? Feels like there should be another tag for rendering it.

I agree. R Markdown has R code execution as part of it's Markdown flavor and it distinguishes code block vs code execution as ```R vs ```{R}

It feels like Markdown and Jupyter notebooks in on the path to merging, and markdown is like the dumbed (need a different word for this, simplicated (though that that word is cumbersome)) down yaml which is a simplicated xml.

Why don't we just go back to xml and provide decent structured editors?

Post reply on HN