Summary
StreamMarkdown passes allowDangerousHtml: false to remark-rehype, which strips raw HTML in Markdown. That option is not exposed as a component prop, so consumers cannot enable HTML rendering without patching the library.
Context / question
- Is disabling raw HTML intentional as the default security posture? (Understood if yes.)
- Would you consider exposing this (e.g.
allowDangerousHtml?: boolean, default false) so trusted content can opt in?
Current behavior
In src/StreamMarkdown.ts, remarkRehype is used with a fixed option:
.use(remarkRehype, { allowDangerousHtml: false })
Summary
StreamMarkdownpassesallowDangerousHtml: falsetoremark-rehype, which strips raw HTML in Markdown. That option is not exposed as a component prop, so consumers cannot enable HTML rendering without patching the library.Context / question
allowDangerousHtml?: boolean, defaultfalse) so trusted content can opt in?Current behavior
In
src/StreamMarkdown.ts,remarkRehypeis used with a fixed option: