fix: preserve align attribute on block elements during sanitization

crates/marknest-core/src/lib.rs

@@ -1776,9 +1776,9 @@ fn build_html_document(title: &str, body_html: &str, options: &RenderOptions) ->
 fn sanitize_html_fragment(html_fragment: &str) -> String {
     let mut sanitizer = HtmlSanitizerBuilder::default();
     sanitizer.url_relative(UrlRelative::PassThrough);
-    sanitizer.add_generic_attributes(["aria-label", "class", "id", "title"]);
+    sanitizer.add_generic_attributes(["align", "aria-label", "class", "id", "title"]);
     sanitizer.add_tags(["details", "figure", "figcaption", "input", "nav", "summary"]);
-    sanitizer.add_tag_attributes("img", ["width", "height", "align", "loading"]);
+    sanitizer.add_tag_attributes("img", ["width", "height", "loading"]);
     sanitizer.add_tag_attributes("input", ["type", "checked", "disabled"]);
     sanitizer.add_tag_attributes("details", ["open"]);
     sanitizer.clean(html_fragment).to_string()

crates/marknest-core/tests/fixtures/workspace_align_center/README.md

@@ -0,0 +1,13 @@
+<p align="center">
+<img src="https://example.com/logo.svg" height="150">
+</p>
+<h1 align="center">
+Project Name
+</h1>
+<p align="center">
+A short description of the project.
+</p>
+
+## Features
+
+- Feature one

crates/marknest-core/tests/render_workspace_html.rs

@@ -365,6 +365,23 @@ fn sanitizes_raw_html_by_default_while_preserving_safe_readme_markup() {
     assert!(rendered.html.contains("data:image/svg+xml;base64,"));
 }
 
+#[test]
+fn preserves_align_attribute_on_block_elements() {
+    let rendered = render_workspace_entry(&fixture_path("workspace_align_center"), "README.md")
+        .expect("workspace entry should render");
+
+    assert!(
+        rendered.html.contains("align=\"center\""),
+        "align attribute on <p> should be preserved; got: {}",
+        rendered.html
+    );
+    assert!(
+        rendered.html.contains("<h1 align=\"center\">"),
+        "align attribute on <h1> should be preserved; got: {}",
+        rendered.html
+    );
+}
+
 #[test]
 fn can_disable_html_sanitization_for_trusted_documents() {
     let rendered = render_workspace_entry_with_options(