3 ms·
Unfortunately, that is absolutely not true in any implementation derived from the original Markdown.pl without a whole lot of bugfixes Because of the chickensh
by blasdel 14y ago
Unfortunately, that is absolutely not true in any implementation derived from the original Markdown.pl without a whole lot of bugfixes
Because of the chickenshit way he attempted to escape things by replacing them with their MD5 hashes and then switching them back, you can encode anything you want to be output by the markdown processor. Reddit was owned by a viral XSS comment because of this in 2009, it's been exploited a few other times since.
- bitcartel 14y agoFound the info, interesting. Easy to think plain text is safe and forget about the parser. http://www.f-secure.com/weblog/archives/00001777.html http://www.f-secure.com/weblog/archives/00001777.html http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-us.html http://blog.reddit.com/2009/09/we-had-some-bugs-and-it-hurt-...