appview/pages: don't sanitize plaintext readmes

Also, sanitize the raw markdown before rendering.

Signed-off-by: Anirudh Oppiliappan <[e-mail]>

appview/pages/pages.go

···
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/object"
-	"github.com/microcosm-cc/bluemonday"
 )
 
 //go:embed templates/* static
···
 		ext := filepath.Ext(params.ReadmeFileName)
 		switch ext {
 		case ".md", ".markdown", ".mdown", ".mkdn", ".mkd":
+			htmlString = p.rctx.Sanitize(htmlString)
 			htmlString = p.rctx.RenderMarkdown(params.Readme)
 			params.Raw = false
-			params.HTMLReadme = template.HTML(p.rctx.Sanitize(htmlString))
+			params.HTMLReadme = template.HTML(htmlString)
 		default:
-			htmlString = string(params.Readme)
 			params.Raw = true
-			params.HTMLReadme = template.HTML(bluemonday.NewPolicy().Sanitize(htmlString))
 		}
 	}
 

appview/pages/templates/repo/index.html

···
 {{ end }}
 
 {{ define "repoAfter" }}
-    {{- if .HTMLReadme -}}
+    {{- if or .HTMLReadme .Readme -}}
         <section
             class="p-6 mt-4 rounded-br rounded-bl bg-white dark:bg-gray-800 dark:text-white drop-shadow-sm w-full mx-auto overflow-auto {{ if not .Raw }}
                 prose dark:prose-invert dark:[&_pre]:bg-gray-900
···
             {{ end }}"
         >
             <article class="{{ if .Raw }}whitespace-pre{{ end }}">{{- if .Raw -}}<pre class="dark:bg-gray-800 dark:text-white overflow-x-auto">
-                        {{- .HTMLReadme -}}
+                        {{- .Readme -}}
                     </pre>
                 {{- else -}}
                     {{ .HTMLReadme }}