Waylan Limberg wrote:
Regarding the security issues, I understand your concerns, but there
are some situations were all document authors are trusted
(authenticated) users and have a legitimate need for that feature. We
can't cut them off for everyone else. However, I know that
Python-Markdown has an option to not allow any html in a document
(this "safe_mode" can be set to either replace with a customizable
message, remove completely, or escape the html). Of course, to stay in
line with the Markdown standard, it is off by default, but very easy
to turn on in your code. Other implementations may offer a similar
option.
Yes, there are situations where all document authors are trusted
(authentication isn't trust though), but the fact remains that this
makes markdown completely unusable for anything else. And worse, people
are not made aware of this fact. I only encountered this by coincidence,
because one of my users entered what looked like html tags into the forum.
In summary:
Markdown wasn't designed to handle this situation. Some implementations
provide a 'safe mode' which aims to filter the code either before or
after markdown conversion.
Markdownj (Java, which I've been using) doesn't provide such an option.
Markdown.pl doesn't provide such an option.
Nanoki tries to, and fails (see related mail by Michel Fortin) on:
<script <!--
alert("Hello world!")
</script <>
PHP Markdown has something like this, and it has to be enabled in the
source (?). It fails when no_markup=true and no_entities=false on:
<script>alert('hallo');</script>
Python markdown has such an option and it appears to work for simple
tests. Looking at the code, python markdown apparently creates an XML
document tree and serializes it, making sure that the generated code is
always valid XML (that's a very good design choice if I may say so).
I havn't tried Pandoc, which was also mentioned by John MacFarlane.
Ok, thanks everyone for their input. It remains the potential issue of
some browsers automatically executing javascript when used as a source
URL for an image, and possibly also the use of javascript urls in links.
Other than that I think I'll move forward using the python markdown
implementation via jython or start porting it to java.
Again, thanks everyone for their quick replies.
Cheers,
-- Ulf
_______________________________________________
Markdown-Discuss mailing list
[email protected]
http://six.pairlist.net/mailman/listinfo/markdown-discuss
