mirrors/marked
1
0
Fork 0
mirror of https://github.com/markedjs/marked synced 2024-11-22 17:37:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

chore(docs): add a secure example to the documentation. (#2462)

Browse Source 
* Add a sanitized example

* Remove !

* move example below warning

Co-authored-by: Florian Hantke <florian.hantke@cispa.de>
This commit is contained in:
FHantke 2022-05-07 18:37:21 +02:00 committed by GitHub
parent 50dbfac729
commit 74ccecf771
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@ -43,11 +43,14 @@ Also read about:
## Usage
### Warning: 🚨 Marked does not [sanitize](https://marked.js.org/#/USING_ADVANCED.md#options) the output HTML. Please use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the output HTML! 🚨
### Warning: 🚨 Marked does not [sanitize](https://marked.js.org/#/USING_ADVANCED.md#options) the output HTML. Please use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the *output* HTML! 🚨
```
DOMPurify.sanitize(marked.parse(`<img src="x" onerror="alert('not happening')">`));
```
**CLI**
``` bash
# Example with stdin input
$ marked -o hello.html

6
docs/INDEX.md
View File

@ -25,7 +25,11 @@ These documentation pages are also rendered using marked 💯
<h2 id="usage">Usage</h2>
### Warning: 🚨 Marked does not [sanitize](/using_advanced#options) the output HTML. Please use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the output HTML! 🚨
### Warning: 🚨 Marked does not [sanitize](/using_advanced#options) the output HTML. Please use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the *output* HTML! 🚨
```
DOMPurify.sanitize(marked.parse(`<img src="x" onerror="alert('not happening')">`));
```
**CLI**