XSS possible

[treuter]

It is possible to read the user's cookie, e.g.:

[XSS](javascript:window.onerror=alert;throw%20document.cookie)

Maybe there should be a configuration option to prevent creating javascript code.

[tivie]

Showdown doesn't sanitize the input. This is by design since markdown relies on it to allow certain features to be correctly parsed into HTML. This, however, means XSS injection is quite possible.

Further reference:

• URLs are improperly escaped #57
• XSS vulnerability #70
• Where could I find your documentation? #71
• Add an option to escape HTML #182
• Markdown's XSS Vulnerability (and how to mitigate it)

[treuter]

Thanks for the information!