fixed implementation of UGC content uploader

nonpacks/common/markdown.py

@@ -0,0 +1,14 @@
+from markdown_it import MarkdownIt
+
+_markdown = MarkdownIt('js-default', {'html': False, 'breaks': True})
+
+
+def render_markdown(text):
+    """Render markdown text to safe HTML.
+
+    Raw HTML is escaped and dangerous link schemes (javascript:, data:,
+    vbscript:) are rejected by markdown-it with html=False.
+    """
+    if not text:
+        return ''
+    return _markdown.render(text).rstrip('\n')