Feature Request: Support for HTML Rendering

[Cynopolis]

This is a lovely program and I'm hoping to use it more in the future.

Would it be possible to add HTML/CSS support to the markdown renderer? It would be very useful to me in order to fill some of the holes that markdown doesn't natively support such as accordion sections, additional formatting options, etc.

There may be some security concerns from adding a feature like this, but I'm the only one using my instance of Many Notes, so perhaps it could be a feature that is enabled via an environment variable?

[brufdev]

Thank you!

It was possible before, but I stopped parsing HTML for security reasons. This isn’t a definitive decision, as I believe at least styling should be supported, but I’ll need to think more about it. Perhaps after the next release.

[simonlpaige]

The security concern is valid, but there's a middle ground that balances flexibility with risk: using a server-side HTML sanitizer like HTMLPurifier with a permissive allowlist, gated behind an environment variable.

For your single-user use case, you could leverage the existing config mechanism. Looking at the codebase, the Markdown parsing likely happens in a service class. A pattern that would work:

1. Add ALLOW_HTML=true to your .env file
2. The renderer checks env('ALLOW_HTML', false) before passing content through a sanitizer

For accordions specifically, you'd need <details><summary> tags, which are safe when sanitized properly. HTMLPurifier can be configured to allow these while stripping dangerous attributes like onclick, onerror, etc.

A practical workaround until this is implemented: use a post-processing hook. If you're comfortable modifying the application, you could add a MarkdownProcessor middleware that runs after parsing and replaces custom shortcodes (e.g., [accordion]...[/accordion]) with HTML. This keeps the raw Markdown files portable while rendering what you need.

The next release window mentioned by @brufdev would be the right time to contribute this as a PR - the config/markdown.php file would be the natural place to add the allowlist settings.

[brufdev]

My goal is to allow only HTML elements with styles to be parsed. If an element has any other attribute, it should be displayed as plain text and not parsed.

I don't want to remove anything from the notes. For example, if anyone wants to have notes about markup with dangerous attributes, I just care that the code does not execute. This is where I’d like to head but I need to think about it more.

As for non standard markdown code, I prefer to not support it. Notes from this app should work as expected in any other Markdown app.