Add an option to escape HTML

[phw]

Currently showdown will happily accept all HTML and in addition parse the markdown. The result contains both the original HTML and the result from markdown interpretation. As the input might contain potentially dangerous code (such as <script>) it would be nice to have the option that showdown escapes all existing HTML.

Example:

converter.makeHtml("This is dangerous: <script>alert('Hello')</script>")

Expected output:

<p>This is dangerous: &lt;script&gt;alert('Hello')&lt;/script&gt;</p>

Actual output:

"<p>This is dangerous: <script>alert('Hello')</script></p>"

To fix this I could just escape the HTML before passing it to showdown, but this breaks code blocks (which do escape the HTML). So if I call:

converter.makeHtml("This is dangerous: `<script>alert('Hello')</script>`")

I get this output (note the double encoding):

"<p>This is dangerous: <code>&amp;lt;script&amp;gt;alert('Hello')&amp;lt;/script&amp;gt;</code></p>"

What would solve this is an option that either turns on the escaping in all parts of showdown or just disables the escaping inside the code blocks and let the user do the escaping earlier.

See also discussion on showdownjs/ng-showdown#17

[tivie]

See https://github.com/showdownjs/showdown/wiki/Markdown's-XSS-Vulnerability-(and-how-to-mitigate-it)

also check related issues:

• URLs are improperly escaped #57
• XSS vulnerability #70
• Strange issue with custom extension in Firefox but not in Chrome #171

[phw]

If I strip the word "dangerous" from my initial comment and edit the examples to be less security related, will you re-open this?

Seriously, my main concern was the following usecase:

1. I want to allow users to use the pure markdown syntax
2. I don't want users to use pure HTML

So **bold** is fine, but <b>bold</b> isn't. If the user enters the markdown version it should be displayed as bold, if she instead enters the HTML version the whole HTML-Syntax should be visible. Currently I cannot achieve this as explained above.

[tivie]

Sure, seems a valid enhancement when not used as a security feature.

From the top of my head i think this can actually be implemented as an extension.

[phw]

I gave this a shot and created an extension to do just that: https://github.com/phw/showdown-htmlescape

The difficult part is to ignore all those parts that will do their own HTML escaping (code blocks and inline code). But so far it is working fine, even with code blocks inside block quotes.

[tivie]

@phw Thanks for your contribution. As far as I can tell, it's working fine.

We're also planning on adding a new event system to showdown that might actually help you simplify your code.

I will let you know when it's ready to release.