search

rhysd / Shiba

Rich markdown live preview app with linter
774 stars 55 forks source link

Add support for html tags #46

Open 00sapo opened 5 years ago

00sapo commented 5 years ago

It would be useful if Shiba could support standard html tags, such as iframes. It would allow to include a lot of contents (e.g. YouTube, etc...)

rhysd commented 5 years ago

I'm sorry for catching this issue late.

Due to security reason, HTML tags are sanitized. Some HTML tags such as <img>, <cite>, <kbd>, ... (listed here). This is the same as GitHub.

https://github.com/rhysd/marked-sanitizer-github

Without this sanitization, loading malicious markdown documentation causes arbitrary code execution (reported at #42).