> On Sep 6, 2014, at 12:08 AM, Andrei Fangli <[email protected]> wrote: > > The JavaScript version is only good for preview at client-side to avoid > posting to the server one to many times. To do client-side parsing and > sending it to the server in the final format is a serious security leak > (trusting that a post request sends a valid and harmless html is wishful > thinking).
There’s little difference: if you are accepting markdown from untrusted users, you MUST also pass the resulting HTML through an XSS filter of some sort, no matter whether the markdown transform happens on the front or back end. Alan _______________________________________________ Markdown-Discuss mailing list [email protected] http://six.pairlist.net/mailman/listinfo/markdown-discuss
