开发者

Are text editors that use Markdown by detault safer than other text editors

I'm familiar with CKEditor which converts bold text to its HTML tags <strong>. Other editors (like the editor on this site) use Markdown formatting and I see bold te开发者_高级运维xt wrapped in stars instead of HTML like this **text**.

Sp does this mean that using a markdown editor protects you by default from any XSS in that user input? I think yes (which is the the main reason I want to use a markdown editor and not ckeditor), but want to double check.


According to this: http://michelf.com/weblog/2010/markdown-and-xss/

It doesn't escape XSS on default


There are no XSS safe client side editors. Even if the editor does not allow you to insert arbitrary HTML, it is trivially easy for someone to bypass the editor and submit arbitrary HTML.

The only safe solution is to sanitize the HTML on the server.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜