3 ms·
The output from a markdown to HTML converter is not text content. It's HTML. And it needs to be sanitized before it is added to the DOM. That's just a quick
by wccrawford 5y ago
The output from a markdown to HTML converter is not text content. It's HTML. And it needs to be sanitized before it is added to the DOM.
That's just a quick example. There are plenty of other conversions of user data that can't simply be displayed as plain text and need to be converted to HTML. That conversion doesn't always happen in the browser. Sometimes it's actually just straight HTML that needs to be displayed, but because it came from a user, it needs to be sanitized.
- alanfranz 5y agoI'm taking a better look at the sanitizer API before going on with this discussion. But, pardon me, the proper way to render markdown in the browser would be to let the markdown converter output a node or element. The markdown converter, when doing the conversion, knows what to do, which part of markdown must be converted to what HTML element, and what should be inserted as textContent. So I would imagine that when the markdown parser encounters *** This is a section writes something like: var el = document.createElement("h3") el.textContent = ... so an element is returned by the parser at the end, not a string. "Sanitizing" a string afterwards will either yield a safe (but possibly wrong) result, or a correct (but possible unsafe) result. You cannot decide what is safe if you don't have context. Unless "safe" means something like "nothing that looks like a script". What then if the markdown converter decides that it needs js for some feature?