Ruby on Rails: URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag

The markdown converter treats every element as trusted internally-generated markup and emits its text verbatim. Contenttomarkdown only creates that tag when serializing attachments, but the visitor does not distinguish internal nodes from user-supplied ones. A rich-text body containing a literal...