5 ms·
Safety. If you exclude HTML tags, Markdown is safe. People can't inject code. I know this can be done for HTML as well, but it's harder.
by alexchamberlain 14y ago
Safety.
If you exclude HTML tags, Markdown is safe. People can't inject code.
I know this can be done for HTML as well, but it's harder.
- blasdel 14y agoUnfortunately, that is absolutely not true in any implementation derived from the original Markdown.pl without a whole lot of bugfixes Because of the chickenshit way he attempted to escape things by replacing them with their MD5 hashes and then switching them back, you can encode anything you want to be output by the markdown processor. Reddit was owned by a viral XSS comment because of this in 2009, it's been exploited a few other times since.
- bitcartel 14y agoFound the info, interesting. Easy to think plain text is safe and forget about the parser. http://www.f-secure.com/weblog/archives/00001777.html http://www.f-secure.com/weblog/archives/00001777.html http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-...