Use xss.js to sanitize HTML mixed with Markdown. Closes #125.

OpenUserJS · Jun 2, 2014 · e66d374 · e66d374
1 parent 485e3fd
commit e66d374
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/libs/markdown.js b/libs/markdown.js
@@ -1,5 +1,6 @@
 var marked = require('marked');
 var hljs = require('highlight.js');
+var xss = require('simple-xss');
 var renderer = new marked.Renderer();
 
 // Automatically generate an anchor for each header
@@ -29,11 +30,11 @@ marked.setOptions({
   tables: true,
   breaks: true,
   pedantic: false,
-  sanitize: true,
+  sanitize: false, // we use xss to sanitize HTML
   smartLists: true,
   smartypants: false
 });
 
 exports.renderMd = function (text) {
-  return marked(text);
+  return marked(xss(text));
 };
diff --git a/package.json b/package.json
@@ -14,6 +14,7 @@
     "async": "*",
     "aws-sdk": "*",
     "toobusy-js": "*",
+    "simple-xss": "*",
     "passport": "*",
     "passport-github": "*",
     "passport-amazon": "*",