3 ms·
https://github.github.com/gfm/#disallowed-raw-html-extension- https://github.github.com/gfm/#disallowed-raw-html-extension... Why this? This is not a working b
by legulere 10y ago
https://github.github.com/gfm/#disallowed-raw-html-extension- https://github.github.com/gfm/#disallowed-raw-html-extension...
Why this? This is not a working blacklist to prevent XSS (e.g. onload="...")
- Xylakant 10y agoIt's not meant as an xss prevention but as a safety to prevent rendering errors.
- tanoku 10y agoHi there! As the spec explains, this is a Markdown specific blacklist that prevent the tags that would otherwise "break" the content of the Markdown document. A document that contains these tags will not be parsed properly by an HTML5 compliant parser; the parser will "swallow" other chunks of Markdown content that come after the tags. Hence, we disable the tags altogether. This is an UX feature, not a security feature. XSS prevention, and a plethora of other security checks, are performed by our user content stack -- but this functionality is shared for all markup languages in GitHub (MD, RST, ASCIIDOC, ...), so it's not discussed in this spec.
- scrollaway 10y agoWow, TIL about the <plaintext> tag. Here I thought I knew most of the corner cases of HTML.
- dbbk 10y agoWhat's bonkers to me is that there is no closing tag, everything after it is no longer parsed as HTML.
- jeffmcjunkin 10y agoIt's also a great way to check if user input's being parsed server-side! :)
- ptx 10y agoIf it disallowed certain words (i.e. treated them specially instead of just reproducing the text as written) such as "</plaintext>" it wouldn't be plain text.