tillkruss
commented
6 years ago The "security issue" here is that generated HTML may contain XSS, which can be solved by escaping output yourself. See example blow.
FriendsOfPHP/security-advisories has included it as well.
We considered switching to CommonMark a while back, but it doesn't support tables (GFM).
Parsedown has already been forked, maybe we can switch to the community maintained version if the original author of Parsedown doesn't get his act together.
This is what I personally use for escaping Parsedown output (@JosephSilber suggested using Stauros a while back):
use Parsedown;
use Stauros\Stauros;
use Stauros\HTML\Config;
$parsedown = (new Parsedown)->setMarkupEscaped(true);
$stauros = new Stauros(
new Config([
'a' => ['href' => true, 'title' => true],
'b' => [],
'br' => [],
'blockquote' => ['cite' => true],
'cite' => [],
'code' => [],
'em' => [],
'i' => [],
'p' => [],
'q' => ['cite' => true],
's' => [],
'strike' => [],
'strong' => [],
])
);
$html = $stauros->scanHTML(
$parsedown->text($markdown)
);
aidantwoods
paragonie-scott
garygreen
vpratfr
mfn
JeppeKnockaert
Description:
erusev/parsedown, a package used by Laravel, currently has unfixed security issues (see https://github.com/erusev/parsedown/pull/495). These have been open since mid-ish-2017, the maintainer seems to have abandoned the project, leaving them unfixed. roave/security-advisories has recently included it in their vulnerable packages list (people using security-advisories on CI/CD systems may end up with errors during tests/deployment).
Steps To Reproduce:
N/A
Suggestions
It'd suggest moving away from this package to a more actively maintained MD parser.