gomarkdown / markdown

markdown parser and HTML renderer for Go
Other
1.36k stars 171 forks source link

Fix: respect DisableTags in OutTag func #301

Closed shwarcu closed 7 months ago

shwarcu commented 7 months ago

Explanation of the issue

I was checking how DisableTags works and I think intention of the autor was to disable HTML tags completely. However at the moment when this field was set, only closing tags were removed.

Reproduction

I added

renderer.DisableTags = 1

after line https://github.com/gomarkdown/markdown/blob/master/cmd/printast/main.go#L56 and copied content of the README.md into example.md

(these are first few lines of README.md)

 markdown git:(master) ✗ go run ./cmd/printast -to-html example.md
HTML of file 'example.md':
<h1>Markdown Parser and HTML Renderer for Go

<a href="https://pkg.go.dev/github.com/gomarkdown/markdown">pkg.go.dev

Package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML.

after my changes it seems to work correctly

markdown git:(fix/disable-opening-tags) ✗ go run ./cmd/printast -to-html example.md              
HTML of file 'example.md':
Markdown Parser and HTML Renderer for Go

pkg.go.dev

Package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML.

(I have tested this on entire README.md content, here for readability I only included partial sample).

Motivations

I'm proposing this fix for 2 reasons:

kjk commented 7 months ago

This doesn't seem right.

The intent seems to be to "sanitize" the html output by stripping out the HTML present in markdown (to avoid potentially malicious html propagating from markdown to output HTML).

It was not generate output that is not HTML.

Plus it would be backwards-incompatible change and that alone is reason enough not to change it.

shwarcu commented 7 months ago

Ok, I understand.