3 ms·
One of the strongpoints of Markdown is that the browser doesn't do anything with it. Therefore it's safe to just send it to the client. If browsers started sup
by wmil 4y ago
One of the strongpoints of Markdown is that the browser doesn't do anything with it. Therefore it's safe to just send it to the client.
If browsers started supporting Markdown then they'd inevitably extend it with autoloading resources. This would lead to Markdown XSS attacks. This would lead to developers needing to sanitize all markdown from untrusted sources, as well as scanning blocks of text for inline markdown that could cause problems.
That sounds like a stretch, but it's a well worn path.
- Josh5 4y agoWhat? How could rendered markdown get used for XSS?
- rtev 4y agoMarkdown has been a popular vector for XSS in the past due to the more esoteric media embedding features it has.
- kazinator 4y agoAnd so ... if a given markdown author finds that some commoly used browsers don't render things the way they want (or a different subset of browser does the right thing when they fiddle with the markdown, never reaching a happy consensus), they will just throw up their arms and use their mardown->HTML converter of choice.