What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 127 Stack Exchange communities.

I wasn't sure if I should post this here or as an issue of some sort at the markdown sharp page. (We'll see if this gets closed :P )

I've been using MarkdownSharp in my blog and I did a few XSS tests, and it doesn't do any verification on the links, and as far as I can tell, there is no option to enable any sort of verification. So links like:

[test](javascript://blah)

will be encoded without error. Stack Overflow however, will correct this behavior and make it so that it's not an XSS vector. Why is this not in MarkdownSharp? Another related thing is there is not Stack Overflow's special comment implementation of Markdown which only enables a select few markdown features.

Are there any plans to copy what Stack Overflow is currently doing to the MarkdownSharp project?

share|improve this question
add comment

2 Answers

The most recent MarkdownSharp on Google Code is also the most recent copy in our codebase (as of 4 days ago).

The Stack Exchange network makes some non-standard extensions to Markdown (to the extent Markdown is a standard, anyway). MarkdownSharp is more or less standard compliant, so those extension aren't likely to be opened up.

Additionally, Markdown has nothing to say about XSS or HTML sanitation.

So, when SO renders a post the code flow is basically:

public string RenderPost(string raw)
{
    var markdown = ExtensionsBeforeCooking(raw);
    var cooked = (new MarkdownSharp.Markdown()).Transform(markdown);
    var unsafe = ExtensionsAfterCooking(cooked);
    var safe = Sanitize(unsafe);
    var ready = ExtensionsAfterSafe(safe);

    return ready;
}

I don't think there are any plans to open up "MarkdownMini", as its not nearly as general purpose as MarkdownSharp (implementing only a subset of Markdown, and having some of our custom extensions mixed in).

share|improve this answer
1  
See also: How is input sanitized in the SOFU World? –  Arjan Oct 2 '11 at 15:04
    
Could you provide the sanitization function? –  Hasib Mahmud May 9 at 10:56
add comment

While Kevin is correct – it's not the purpose of Markdown to offer any sanitation (what if you write your own blog in Markdown and want to include JavaScript somewhere?) – both the HTML sanitizer and the tag balancer have been public for a very long time.

And since the Stack Exchange Data Explorer is MIT licensed and includes all this, you're free to pull that out as well.

But I disagree that this should be part of core Markdown.

share|improve this answer
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .