vlang / gitly

Light and fast GitHub/GitLab alternative written in V
GNU General Public License v3.0
1.37k stars 72 forks source link

feature: preventing XSS attacks in Markdown files #206

Closed ghost closed 1 year ago

ghost commented 2 years ago

Feature for preventing XSS attacks and running malicious JavaScript code in Markdown files. Yep, it is parsing HTML via regular expressions, but it is a temporary solution. In the future, I'll implement it with the built-in library, when the markdown library will support escaping HTML tags via DOM parsing. Maybe, I will do it.

P.S: I use the PCRE library because the built-in library couldn't parse my expressions.


Before: source

After: dom