Closed csoni111 closed 7 years ago
Now the code to process markdown in the message is on the server side, instead of on the client side. Also I have added a list of allowed html tags and attributes for respective tags. This will limit markdown support and also help cope xss attack.
If a user passes <del>Hello</del>
into message box. This will be seen in the chat as <del>Hello</del>
and not as Hello . It's because on passing it through the showdown js, the html tags will be escaped like this <del>Hello</del>
. So no harm can be done!
@csoni111 Anything left on this?
@captn3m0 Not from my side! I was hoping someone would merge it.
Resolves #48
<a href="url" target="_blank">url</a>