Markdown component is a React server component that renders markdown content into React elements. It parses markdown using the core parser and provides customizable rendering for all markdown node types.
Basic usage
Props
The markdown content to parse and render. This should be a valid CommonMark-formatted string.
Custom component renderers for markdown nodes. Pass an object with component overrides to customize how specific markdown elements are rendered.See Custom renderers for detailed documentation on available component types.
Component behavior
TheMarkdown component:
- Parses the markdown content using
MarkdownParser - Renders each parsed node as a React component
- Uses default HTML elements unless custom renderers are provided
- Applies security measures like URL validation for links and images
This is a React Server Component and requires
"server-only" mode. It cannot be used in client components.Default rendering
When no custom components are provided, markdown elements render to standard HTML:| Markdown element | HTML output |
|---|---|
| Headings | <h1> through <h6> |
| Paragraphs | <p> |
| Lists | <ul> and <ol> with <li> |
| Code blocks | <pre> |
| Inline code | <code> |
| Links | <a> with URL validation |
| Images | <img> with URL validation |
| Blockquotes | <blockquote> |
| Tables | <table> with <thead> and <tbody> |
| Emphasis | <em> |
| Strong | <strong> |
| Thematic break | <hr> |
| Hard break | <br> |
Security features
The component includes built-in security measures:- URL validation: Links and images are validated to prevent XSS attacks
- Safe protocols: Only safe URL protocols are allowed (blocks
javascript:,vbscript:,file:) - Data URLs: Only image data URLs with safe MIME types are permitted (
image/gif,image/png,image/jpeg,image/webp) - HTML escaping: URLs are HTML-escaped to prevent injection attacks