[bushidapengyou-cell]

Resolves #4911

Accept explicit file:// source URIs when resolving relative images in Markdown and HTML. Local-fetch permissions and path traversal checks remain enforced. Related to #4816.

Review evidence:

Before: file URI bases caused Markdown conversion to fail. HTML kept converting through #4601's tolerance but left the image empty.

After: valid relative images load when local fetching is enabled. Rejected images remain empty, and Markdown conversion continues. Empty file URI paths are rejected.

Tests cover encoded paths, localhost, UNC normalization, local-fetch permissions, and traversal handling. Full UNC resolution is tested only on Windows. No reference data changed.

Validation:

• File URI regression tests: 10 passed.
• Affected suites: 207 passed, 1 skipped, 4 known Windows path assertion failures.
• Local coverage confirms execution of the normalization and Markdown error-handling paths.
• Applicable prek hooks, Ruff, Tach, dprint, lock validation, and diff checks passed.
• ty check returned 0 with warnings. Full read-only checks still report existing line-limit and local skill-link issues.

CI follow-up: cc1f6fa6 fixes the Ubuntu UNC test failure by adding a Windows-only condition and a portable normalization test. The previous failure skipped core coverage upload. Updated CI and Codecov results remain to be verified.

Checklist:

• Documentation has been updated, if necessary.
• Examples have been added, if necessary.
• Tests have been added, if necessary.

[github-actions]

✅ DCO Check Passed

Thanks @bushidapengyou-cell, all your commits are properly signed off. 🎉

[mergify]

Merge Protections

🟢 Merge protection satisfied — ready to merge.

Show 1 satisfied protection

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?(!)?:

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[bushidapengyou-cell]

Fixed the Ubuntu UNC test. Full UNC only on Windows now, plus a cross-platform test. PR updated—waiting on CI.

[github-actions]

AI triage (advisory)

Checked commit 8d53347c60. The analysis read the diff only. It did not run code from this pull request.

This PR adds support for file:// base URIs when resolving relative image paths in Markdown and HTML documents. It also catches ValueError during Markdown image loading to keep conversion working when an image path is invalid.

Topic labels added: bug, markdown, html, error-handling.

CI safety: no concern found. A maintainer must still approve CI.

5 related pull request(s) in the same code

PR	State	Signal	Assessment
#4848	open	changes the same code	related: PR #4848 modifies Markdown HTML block handling and shares Markdown backend files, but it addresses a different issue.
#3891	open	changes the same code	related: PR #3891 modifies inline whitespace processing across backend and test files, but it addresses a different issue.
#4921	closed	also references issue #4911	related: PR #4921 is a closed pull request that addressed the same issue.
#4816	merged	referenced as #4816	related: PR #4816 is a merged pull request that added local path resolution for Markdown images.
#4601	merged	referenced as #4601	related: PR #4601 is a merged pull request that added error tolerance for HTML image path traversal.

_{The ai:* labels are advisory. They do not approve CI and they do not add tests:full. A new push runs this check again.}

[github-actions]

AI first review (advisory): no blocker found

This review covers the full diff at 8d53347c60. It read the code and did not run it.

The _local_base_path conversion and the ValueError guard in md_backend.py are correct. The unresolved risk is the broken CI run that produced the low Codecov number; the author says the fixed head has not been verified yet. The reviewer must confirm that the corrected CI run passes all 10 new tests before merging.

_{A maintainer makes the merge decision. This review never approves the pull request.}

[dolfim-ibm]

#4921 (closed in favor of this PR) also covered JATS: jats_backend.py _load_figure_image still returns None when base_path is a file:// URI. Please add that path here, with credit to @taran-dev4u (a Co-authored-by trailer if you reuse their change). @taran-dev4u, a review from you here is very welcome, because you know this code path.

Two more points:

• _local_base_path: a non-localhost authority (file://server/share/...) becomes //server/... on POSIX, which reads as a local root path. Reject a non-localhost authority outside Windows.
• md_backend.py _load_image_ref now catches ValueError, so a path-traversal image no longer stops the Markdown conversion. That matches the HTML backend (fix(html): keep converting when a link or image points outside the base directory #4601) and is fine, but say it in the PR description.

Nit: test_local_base_path_normalizes_unc_authority monkeypatches url2pathname, so it tests the implementation. A test with a real path covers the behavior.

[PeterStaar-IBM]

lgtm!