Custom BBCode

[jzelinskie]

We discussed it a little bit in IRC and continuing to use BBCode is probably the best for comments/forum posts, but the quality in BBCode libraries is pretty low and we need support for our own custom types like the spoiler tag. Ideas welcome.

[senturio]

My current vote is https://github.com/frol/postmarkup

The "bbcode" PyPI package is at least vulnerable to trivial CSS injection, which can be used for fun things like clickjacking, and it seems to have no concept of actually whitelisting inputs. We'd have to put in a decent amount of elbow grease to fix it.

Python BBcode libraries don't appear to be that popular >_>

[superbobry]

How about ReStructuredText as a markup of choice?

[senturio]

I'm more pro-markdown.

Choices:

• Use Markdown. This is my favourite at the moment.
• Use reStructuredText. This is also plausible.
• Use BBCode. This means "adopting" a library.
• Default to Markdown and allow swapping out the backend in the settings (what I've done so far). NOTE that this is not per-form field. That's ridiculous.

Pros of Markdown:

• Reddit uses it
• GitHub uses it
• Stack Exchange uses it
• Therefore, it's likely people have come across it before and will therefore be semi familiar with it.

Pros of rST:

• Python woo!

Pros of BBCode:

• Known quantity - people know and understand.

Cons of Markdown:

• Not BBcode - this means a change from the status quo.

Cons of rST:

• Not BBcode - change from status quo.

Cons of BBcode:

• Not the same BBcode. STILL a change from the status quo.
• We'd probably have to "adopt" a Python BBcode library, since PyPI's bbcode is shocking and postmarkup hasn't been updated in a while (maybe it doesn't need it - after all, it's not like BBcode's going anywhere fast)
• Security considerations for old/untested libraries.

[senturio]

After some internal discussion within AB we've decided that as AB we're going to stick with BBcode.

I'm probably going to commit and push what I've got then reassign to @endoscient since he knows what's up ;)