Markdown和XSS

问题描述

好吧，所以我一直在SO和其他地方读到有关markdown的信息，用户输入和db之间的步骤通常表示为

Ok, so I have been reading about markdown here on SO and elsewhere and the steps between user-input and the db are usually given as

1. 将markdown转换为html
2. 清除html(带有白名单)
3. 插入数据库

但是对我来说，执行以下操作更有意义:

but to me it makes more sense to do the following:

1. 清除降价标签(删除所有标签-没有例外)
2. 转换为html
3. 插入数据库

1. sanitize markdown (remove all tags -no exceptions)
2. convert to html
3. insert into database

我错过了什么吗?在我看来，这几乎是防XSS的

Am I missing something? This seems to me to be pretty nearly xss-proof

推荐答案

请查看此链接:

http://michelf.com/weblog/2010/markdown-and-xss/

> hello <a name="n"
> href="javascript:alert('xss')">*you*</a>

成为

<blockquote>
 <p>hello <a name="n"
 href="javascript:alert('xss')"><em>you</em></a></p>
</blockquote>

∴¶您必须对 转换为HTML后进行消毒.

∴​ you must sanitize after converting to HTML.

这篇关于Markdown和XSS的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！