Open HiroyukiNIshimura opened 10 years ago
var preview = this.element.find('.rendered-markdown');
if (setting.xssok) {
this.markdown = this.editor.getValue();
}
else {
var stack = $('<div></div>').text(this.editor.getValue());
this.markdown = $(stack).html();
}
this.html = this.converter.makeHtml(this.markdown);
Decent little more ideas :-)
$.widget( "b4m.ghostDown", {
editor: null,
markdown: null,
html: null,
converter: null,
options: {
tagRejections : null
},
var preview = this.element.find('.rendered-markdown');
var dummy = $('<div></div>');
this.markdown = this.editor.getValue();
dummy.html(this.converter.makeHtml(this.markdown));
if (this.options.tagRejections) {
dummy.find(this.options.tagRejections).remove();
}
this.html = dummy.html();
preview.html(this.html);
$('.editor').ghostDown({ tagRejections: 'script foo bar' });
so... it's not committed yet?
Although I am allowed to use because it is very favorite.
But ...
<script> alert ('xss') </ script> ... From being able to run the script such as it's the OK?