release: v1.1.0

- Add _inject_markdown_attr preprocessor to fix md_in_html extension
- Fix double-escaping of Django delimiters in pre>code blocks
- Sanitize audio_id to prevent XSS in inline onclick handler
- Validate audio_url against allowlist (http/https//) to block javascript: scheme
- Align _is_audio_table URL allowlist with convert_tables to fix silent row loss
- Badge images: inline sizing instead of full-width block classes
- Badge links: skip text/underline classes when sole child is img
- Remove dead media_suffixes variable from _is_audio_table

Author: tanhtm

CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.0] - 2026-04-17
+
+### Fixed
+
+- `md_in_html` extension was a no-op; added `_inject_markdown_attr` preprocessor to inject `markdown="1"` into block-level HTML tags so inner markdown (bold, links, badges) renders correctly
+- Double-escaping of Django template delimiters in `<pre><code>` blocks; `<code>` inside `<pre>` is now skipped
+- XSS: `audio_id` now sanitized with `re.sub(r'[^a-z0-9_]', '_', ...)` to strip all non-safe characters from inline JS
+- XSS: `audio_url` validated to only accept `http://`, `https://`, or `/`-prefixed paths; `javascript:` and other schemes are rejected
+- URL allowlist mismatch between `_is_audio_table` and `convert_tables`; both now require the same prefixes, eliminating silent row loss
+- Badge images (inside `<a>`) no longer inherit the full-width block image classes; they receive `inline h-5 align-middle` instead
+- Badge links (sole child is `<img>`) no longer receive text/underline Tailwind classes
+- Removed dead `media_suffixes` variable from `_is_audio_table`
+
 ## [1.0.0] - 2026-04-15
 
 ### Added

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "md2html-tailwind4"
-version = "1.0.0"
+version = "1.1.0"
 description = "A Python package that converts Markdown to HTML using Tailwind CSS 4 for styling."
 authors = [
     { name = "White Neuron Co., Ltd.", email = "contact@whiteneuron.com" },

src/md2html_tailwind4/converter.py

@@ -8,10 +8,12 @@ def __init__(self):
         pass
 
     def convert_md_to_html(self, markdown_content):
+        # Inject markdown="1" so md_in_html processes content inside HTML blocks.
+        preprocessed = self._inject_markdown_attr(markdown_content)
         # Convert Markdown to HTML with richer extensions for broader content support.
         html_content = markdown.markdown(
-            markdown_content,
-            extensions=['tables', 'attr_list', 'fenced_code', 'sane_lists', 'nl2br'],
+            preprocessed,
+            extensions=['tables', 'attr_list', 'fenced_code', 'sane_lists', 'nl2br', 'md_in_html'],
         )
 
         # Parse the HTML content and convert tables to custom divs
@@ -66,7 +68,10 @@ def add_tailwind_classes(self, soup):
             blockquote['class'] = 'mb-5 p-4 sm:p-5 rounded-r-xl border-l-4 bg-neutral-100 text-neutral-700 border-neutral-400 italic text-base leading-7 quote dark:bg-neutral-900/60 dark:text-neutral-300 dark:border-neutral-600'
 
         for img in soup.find_all('img'):
-            img['class'] = 'mx-auto my-5 w-full max-w-4xl h-auto rounded-xl border border-neutral-200 shadow-sm dark:border-neutral-700 dark:shadow-neutral-950/30'
+            if img.parent and img.parent.name == 'a':
+                img['class'] = 'inline h-5 align-middle'
+            else:
+                img['class'] = 'mx-auto my-5 w-full max-w-4xl h-auto rounded-xl border border-neutral-200 shadow-sm dark:border-neutral-700 dark:shadow-neutral-950/30'
 
         for pre in soup.find_all('pre'):
             pre['class'] = 'my-5 overflow-x-auto rounded-xl border border-neutral-200 bg-neutral-950 p-4 text-sm leading-6 text-neutral-100 dark:border-neutral-700 dark:bg-neutral-950 dark:text-neutral-100'
@@ -84,7 +89,9 @@ def add_tailwind_classes(self, soup):
             em['class'] = 'italic text-neutral-700 dark:text-neutral-300'
 
         for a in soup.find_all('a'):
-            a['class'] = 'text-sky-700 underline decoration-sky-300 underline-offset-2 hover:text-sky-900 transition-colors dark:text-sky-300 dark:decoration-sky-600 dark:hover:text-sky-200'
+            children = [c for c in a.children if getattr(c, 'name', None) or str(c).strip()]
+            if not (len(children) == 1 and getattr(children[0], 'name', None) == 'img'):
+                a['class'] = 'text-sky-700 underline decoration-sky-300 underline-offset-2 hover:text-sky-900 transition-colors dark:text-sky-300 dark:decoration-sky-600 dark:hover:text-sky-200'
             if a.get('href', '').startswith(('http://', 'https://')):
                 a['target'] = '_blank'
                 a['rel'] = 'noopener noreferrer'
@@ -123,7 +130,9 @@ def convert_tables(self, soup):
                         audio_button = soup.new_tag('button', **{'class': 'audio-button ml-2', 'data-state': 'play'})
                         audio_button.string = '▶️'
                         audio_url = cells[2].get_text().strip()
-                        audio_id = span2_content.lower().replace(' ', '_').replace('[', '').replace(']', '')
+                        if not audio_url.startswith(('http://', 'https://', '/')):
+                            continue
+                        audio_id = re.sub(r'[^a-z0-9_]', '_', span2_content.lower())
                         audio = soup.new_tag('audio', **{'src': audio_url, 'class': 'hidden', 'controls': ''})
                         audio_button['onclick'] = f"togglePlayPause('{audio_id}', this);"
                         audio['id'] = audio_id
@@ -140,7 +149,6 @@ def convert_tables(self, soup):
     @staticmethod
     def _is_audio_table(rows):
         # Audio-table mode is only valid when the 3rd column consistently contains media URLs.
-        media_suffixes = ('.mp3', '.wav', '.ogg', '.m4a', '.aac', '.webm')
         data_rows = rows[1:] if len(rows) > 1 else []
         if not data_rows:
             return False
@@ -155,7 +163,7 @@ def _is_audio_table(rows):
         if not all(third_values):
             return False
 
-        return all(value.startswith(('http://', 'https://', '/')) or value.endswith(media_suffixes) for value in third_values)
+        return all(value.startswith(('http://', 'https://', '/')) for value in third_values)
 
     def _style_as_responsive_table(self, soup, table):
         table['class'] = 'min-w-full border-collapse text-sm sm:text-base'
@@ -185,8 +193,28 @@ def _style_as_responsive_table(self, soup, table):
     def create_full_html(self, soup):
         return str(soup)
 
+    @staticmethod
+    def _inject_markdown_attr(text):
+        """Inject markdown="1" into HTML block tags so md_in_html processes inner content."""
+        block_tags = r'div|section|article|header|footer|aside|main|nav|figure|figcaption|details|summary'
+
+        def inject(m):
+            if 'markdown=' in m.group(0).lower():
+                return m.group(0)
+            return m.group(0)[:-1] + ' markdown="1">'
+
+        return re.sub(
+            r'<(?:' + block_tags + r')(?:\s[^>]*)?(?<!/)>',
+            inject,
+            text,
+            flags=re.IGNORECASE,
+        )
+
     def escape_django_template_syntax_in_code_blocks(self, soup):
         for tag in soup.find_all(['code', 'pre']):
+            # Skip <code> inside <pre> — the <pre> pass already covers that text.
+            if tag.name == 'code' and tag.parent and tag.parent.name == 'pre':
+                continue
             # Keep code samples readable while preventing Django template parsing.
             if tag.string is not None:
                 tag.string.replace_with(self._escape_django_delimiters(str(tag.string)))