No method to escape Markdown user input without breaking block quotes

[gytdau]

There's no satisfactory way to escape user-submitted Markdown as it uses the the angle bracket > for a block quote, which is escaped into > by default.

Example:

# Title 1

<script src="example.com"></script>

> Blockquote

Escaped:

# Title 1

<script src="example.com"></script>

> Blockquote

The issue here is that the blockquote is no longer recognized as valid Markdown. One solution could be adding your own escape function that ignores all right-angle brackets that are the first character on a line, which would instead convert it to:

# Title 1

<script src="example.com"></script>

> Blockquote

... which then would result in the expected Markdown, with the blockquote intact. Another solution would be to treat the characters > as the right angle bracket itself.

I'm not sure about the impact or complexity of these solutions, so feel free to just throw them out the window.

[GrahamCampbell]

NB, the spec is https://github.com/jgm/CommonMark, so, this issue probably belongs on commonmark itself, rather than this implementation of it.

[colinodell]

It might be possible if you tinker with adding/removing/adjusting the HTML
parsers/renderers. I'd like to simplify this though because it's a common
use case. Basically we'll add a simple config setting to toggle whether
HTML should be left as-is or be escaped.

I'm currently out-of-town and I'll be very busy over the next few weeks, so
it may not get done right away.

On Sat, Oct 31, 2015, 4:31 AM Graham Campbell notifications@github.com
wrote:

NB, the spec is https://github.com/jgm/CommonMark, so, this issue
probably belongs on commonmark itself, rather than this implementation of
it.

—
Reply to this email directly or view it on GitHub
#200 (comment)
.

[GrahamCampbell]

Would still be nice if we could get this into the official spec in some way since it's surely a pretty common thing people want from markdown.

[colinodell]

Based on my research, the spec maintainers have decided that this doesn't belong in the spec:

• XSS hazards need to be addressed commonmark/commonmark-spec#61
• http://talk.commonmark.org/t/cross-site-scripting-issue-in-standard-markdown-example-at-try-standardmarkdown-com/55/6

The JS reference parser has implemented a safe configuration option which is basically what I'd like to replicate: commonmark/commonmark.js@57a1ae3

[colinodell]

@gytdau Please take a look at #201 and let me know what you think.

[gytdau]

@colinodell That looks great.:thumbsup:

[colinodell]

#201 has been merged. I'll try to tag a new release later today.