4 ms·

A bug in the Sundown and Redcarpet markdown parsers may lead to XSS

• captn3m0 12y ago
  No libraries listed on babelmark (or the versions used there) seem to be affected: http://johnmacfarlane.net/babelmark2/?normalize=1&text=_danlec_%40danlec.com http://johnmacfarlane.net/babelmark2/?normalize=1&text=_danl...
  • danlec 12y ago
    Redcarpet would only exhibit the bug if the autolink extension were enabled, i.e. if it would render danlec@danlec.com as a link.
    • captn3m0 12y ago
      Interesting. That makes it much more clearer. I was confused as to why links were being generated without angular brackets being involved.