3 ms·
Ya, but if they built it so msg='<b>msg</b>' that would remove the bold, no? So it is a bit more complex than that if they want to enable user markup. https://
by opendais 13y ago
Ya, but if they built it so msg='<b>msg</b>' that would remove the bold, no?
So it is a bit more complex than that if they want to enable user markup.
https://code.google.com/p/pagedown/source/browse/Markdown.Sanitizer.js https://code.google.com/p/pagedown/source/browse/Markdown.Sa...
https://code.google.com/p/pagedown/wiki/PageDown https://code.google.com/p/pagedown/wiki/PageDown
- dethstar 13y agoI'm not even a front end guy but I'm pretty sure the field they are adding the user message to should handle the style, not the user message.
- opendais 13y agoIf one uses common choices [e.g. Markdown] that isn't how the parsers are designed. It is [message] -> [parse] -> [sanitize], generally.
- voicereasonish 13y agoIf you want to enable user markup, then build a simple parser, and use that to generate the correct styling you require.
- opendais 13y agoMy point was: A) It was not as simple as you suggested if there was markup involved in the message. B) They'd have to use a parser and I linked to a parser that sanitizes that was once used in a pretty big network of sites. I'm uncertain if you misunderstood or are simply agreeing with me in a tone of writing that makes it sound like you disagree.
- ashearer 13y agoI think the point was that it's inherently less safe to allow arbitrary markup and then attempt to sanitize it, than to make a full parser that's incapable of generating unsafe HTML at any stage, all other things being equal. The safety of widely-deployed Markdown + sanitizer libraries is largely thanks to testing at scale and a history of patches for XSS vulnerabilities.