3 ms·
That's because there's no standard for rich text at all, everything is either MS Word, some other bespoke proprietary format, or a kludge on a kludge on a kludg
by qsort 4y ago
That's because there's no standard for rich text at all, everything is either MS Word, some other bespoke proprietary format, or a kludge on a kludge on a kludge.
In part that's due to the shortcomings of HTML itself.
And no, markdown a.k.a. whatever the interpreter accepts is decent enough at what it does but it's not what we are looking for here.
- lopatin 4y agoSo many rich text formats? Ridiculous! We need to develop one universal standard that covers everyone's use cases. [j] https://xkcd.com/927/ https://xkcd.com/927/
- egeozcan 4y agoI never said anything about text formats though. Go crazy as the input, give me HTML as the output. I can sanitize it any way I want on the server-side anyway.
- ta1636467 4y agoSanitize when rendering the HTML, all other paths lead to hell. I agree with granddaddy, the web just didnt cater for this with all the XSS, XSRF etc shennigans. We're left with everyone implementing hacks, or in some cases, getting it right. Mud pie. Slap on an extra dollop.
- egeozcan 4y ago> Sanitize when rendering the HTML, all other paths lead to hell I didn't mean mangle user input when storing. I mean you can do that if you want to parse it and store it as a semantic subset to deliver to the devices that can't render HTML (yes they exist), but I digress. You can sanitize any piece of HTML to a meaningful subset when rendering (well, before render, if you are doing on the server-side) with virtually any language by choosing among many solid libraries.
- stewx 4y agoOffice Open XML (e.g., *.docx) is an ECMA and ISO standard format. https://en.wikipedia.org/wiki/Office_Open_XML https://en.wikipedia.org/wiki/Office_Open_XML
- egeozcan 4y agoThe agents can implement any input mechanism. If I'm writing a text-based browser, I should be able to accept mark-down. Chromium can do whatever fancy thing they please. For output (the value of the field), HTML is good enough already. I don't see the problem.