search

austgl / python-markdown2

Automatically exported from code.google.com/p/python-markdown2
Other
0 stars 0 forks source link

Safe escaped markdown does not handle then ">" symbol properly when not part of a valid tag #21

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
What steps will reproduce the problem?
1. > is encoded as <p>></p>
2. <> is encoded as <p>&lt;></p>
3. <b> is encoded as <p>&lt;b&gt;</p>

What is the expected output? What do you see instead?

I would have thought that the ">" symbol would always be converted to &gt;
regardless of the context.  I'm not sure if it's even an illegal syntax,
but it is probably unsafe.

Original issue reported on code.google.com by mst...@internode.on.net on 9 Oct 2008 at 1:17

GoogleCodeExporter commented 9 years ago 
FWIW, Markdown.pl 1.0.1 has the same issue. :)  Thanks for the bug. Looking 
into it.

Added a test case for this in r173.

To run that test:

  cd test
  python test.py -n issue31

Original comment by tre...@gmail.com on 9 Oct 2008 at 4:57

GoogleCodeExporter commented 9 years ago 
Thanks for the quick response.  The last test case in the html is incorrect, 
you've
got <p></p>, where it should be <p><b></p>

Original comment by mst...@internode.on.net on 10 Oct 2008 at 12:03

GoogleCodeExporter commented 9 years ago 
Yah, I was going to feel that out. *Should* the  be escaped? What about, e.g.,

this is bolded!

?

Original comment by tre...@gmail.com on 10 Oct 2008 at 12:08

GoogleCodeExporter commented 9 years ago 
I thought that was the point with escaping.   You should be able to paste the 
output
in HTML, and it would be displayed as plain text - ie not displaying as bold.

Original comment by mst...@internode.on.net on 10 Oct 2008 at 12:57

GoogleCodeExporter commented 9 years ago 
Ah, sorry, are we talking about safe_mode="escape", i.e. "python markdown2.py 
--safe
escape ..."?

Original comment by tre...@gmail.com on 10 Oct 2008 at 2:52

GoogleCodeExporter commented 9 years ago 
Yeah, sorry for the confusion.

Original comment by mst...@internode.on.net on 10 Oct 2008 at 4:52

GoogleCodeExporter commented 9 years ago 
Fixed in r176. I'm a little leary of the change, given that the other 
implementations
don't bother to escape naked '>' characters. See comments in CHANGES.txt.

Mark, I'd be happier if you had a particular example that showed it is 
problematic to
NOT escape those bare '>' characters. :)

Original comment by tre...@gmail.com on 11 Oct 2008 at 3:38