How does Stack Exchange sanitize the user's text to prevent XSS injections?

I've seen that if I write: (this is the doc about this bug)

> hello <a name="n"
> href="javascript:alert('xss')">*you*</a>

It sanitizes the output, even the preview.

Is it possible to know how it sanitizes the text for preventing this Markdown bug?

  • 2
    Isn't that explained in the article you linked? "So the conclusion is that, if you want real security, you need to filter Markdown’s output, not the input. There’s no other choice." So, I'd assume that's exactly what SE does. But you could peek into the code.
    – Arjan
    Feb 16, 2013 at 22:51
  • I wonder how it can sanitize the preview, the only way (according to my link) is to use Ajax call for sanitize the input, but I don't think it uses this solution..
    – Fez Vrasta
    Feb 16, 2013 at 22:52
  • The preview is generated purely by JavaScript. It does not send it to the server to generate a preview then receive one back.
    – animuson StaffMod
    Feb 16, 2013 at 23:13
  • Yes I was sure, so the javascript markdown parser know how to prevent this vulnerability, is the javascript version open source and downloadable?
    – Fez Vrasta
    Feb 16, 2013 at 23:25
  • Markdown.Sanitizer.js is part of Stack Exchange's open source markdown parser, PageDown. It's not an entirely general-purpose HTML sanitizer, it requires that users use a specific HTML subset.
    – Jeremy
    Feb 17, 2013 at 0:44
  • Could you link me the page where I can download it please?
    – Fez Vrasta
    Feb 17, 2013 at 1:38
  • @FezVrasta code.google.com/p/pagedown
    – yannis
    Feb 17, 2013 at 9:21
  • Thank you. Solved :)
    – Fez Vrasta
    Feb 17, 2013 at 9:38


You must log in to answer this question.

Browse other questions tagged .