• V
    fix(Markdown): render markdown in more secure way · a616cb47
    Vladimir Gorej 提交于
    This commit changes markdown sanitization behaviour in following way:
    
    class, style and data-* attributes are removed by default. These attributes
    open possible vulnerability vectors to attackers.
    
    The original behavior of sanitizer (before this commit) can be enabled by *useUnsafeMarkdown* configuration option.
    Use this configuration option with caution and only in cases when you know
    what you're doing.
    a616cb47
configuration.md 12.1 KB