search

liberapay / liberapay.com

Source code of the recurrent donations platform Liberapay
https://liberapay.com/
1.62k stars 208 forks source link

Cannot write HTML <abbr> (abbreviations) in statement #631

Open jorgesumle opened 7 years ago

jorgesumle commented 7 years ago

I expect Markdown to be able to handle simple HTML tags like the <abbr> tag (as it says in the spec). I understand that some tags like video tags are disabled, but at least some basic HTML support, such as simple abbr tags, would be nice.

Por eso soy [anarcosindicalista](https://es.wikipedia.org/wiki/Anarcosindicalismo), miembro de la <abbr title="Confederación Nacional del Trabajo-Asociación Internacional de los Trabajadores">CNT-AIT</abbr>. produces what is shown in the image below (no abbreviation shown when hover). abbr

Changaco commented 7 years ago

We remove all HTML tags for security reasons. Allowing <abbr> would require implementing a tag+attribute white-list, with proper escaping of attribute values.