XSS (<script>, <style>)

[ghost]

html tags are not striped (or better will be to htmlspecialchars() them)

---

Test string:

<script type="text/javascript">alert('XSS');</script>
<style type="text/css">body { background: red; }</style>

Result: http://sourcebox.io/27978c3083f1bf93be8f9325d3a2a36b/markdown

• PHP Code
• JavaScript Code

---

Is there any option to enable safe html output? Or am I doing something wrong?

---

Github generates this html:

<p>body { background: red; }</p>

You can test that by executing this script in your browser console:

jQuery.post('/preview?text='+ encodeURIComponent('<script type="text/javascript">alert("XSS");</script><style type="text/css">body { background: red; }</style>'), function(html){ alert(html); });

---

Bitbucket.org generates this html:

<p>&lt;script type="text/javascript"&gt;alert('XSS');&lt;/script&gt;
&lt;style type="text/css"&gt;body { background: red; }&lt;/style&gt;</p>

[hkdobrev]

A Markdown parser should accept HTML including scripts.

It is your responsibility to decide whether and how you would sanitize your input.

[ghost]

@hkdobrev ok thanks

[clphillips]

@moldcraft see #161.