starred/markdig
1
0
Fork 0
mirror of https://github.com/xoofx/markdig.git synced 2026-02-03 21:36:36 +00:00
Code Issues 690 Packages Projects Releases 20 Wiki Activity

[Question] Protection against XXS with user-generated input. #121

New Issue
Closed
opened 2026-01-29 14:27:50 +00:00 by claunia · 2 comments
claunia commented 2026-01-29 14:27:50 +00:00
Owner
Copy Link

Originally created by @mloewent on GitHub (Jul 10, 2017).

Hi. I am wondering how I can protect against code execution using this library.
I want users to be able to add code snippets <script>alert("hi");</script>, but to make sure they are encoded.
Currently if a user writes a code snippet without putting it in a code block the snippet will be executed. Is there any way this library can help protect against this?

Thanks.

Originally created by @mloewent on GitHub (Jul 10, 2017). Hi. I am wondering how I can protect against code execution using this library. I want users to be able to add code snippets ```<script>alert("hi");</script>```, but to make sure they are encoded. Currently if a user writes a code snippet without putting it in a ```code block``` the snippet will be executed. Is there any way this library can help protect against this? Thanks.
claunia added the question label 2026-01-29 14:27:50 +00:00
claunia commented 2026-01-29 14:27:53 +00:00
Author
Owner
Copy Link

@mloewent commented on GitHub (Jul 10, 2017):

I have solved this by using a library to sanitize the HTML output of markdig, using a whitelist of HTML tags. Will leave this issue open in case you have any input.

@mloewent commented on GitHub (Jul 10, 2017): I have solved this by using a library to sanitize the HTML output of markdig, using a whitelist of HTML tags. Will leave this issue open in case you have any input.
claunia commented 2026-01-29 14:27:54 +00:00
Author
Owner
Copy Link

@xoofx commented on GitHub (Jul 11, 2017):

Yes, it is recommended to use a sanitizer on the HTML output directly

@xoofx commented on GitHub (Jul 11, 2017): Yes, it is recommended to use a sanitizer on the HTML output directly
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
documentation
enhancement
extension
Hacktoberfest
invalid
PR Welcome!
pull-request
Mirrored from GitHub Pull Request
 question
wontfix
No Label question
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/markdig#121
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?