https://github.com/phw/showdown-htmlescape

Plugin for Showdown to prevent the use of arbitrary HTML and allow only the specific Markdown syntax.
https://github.com/phw/showdown-htmlescape

bower markdown nodejs npm plugin showdown

Last synced: 3 months ago
JSON representation

Plugin for Showdown to prevent the use of arbitrary HTML and allow only the specific Markdown syntax.

• Host: GitHub
• URL: https://github.com/phw/showdown-htmlescape
• Owner: phw
• License: mit
• Created: 2015-08-25T10:25:55.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2022-12-21T11:52:20.000Z (about 2 years ago)
• Last Synced: 2024-10-14T12:20:20.359Z (3 months ago)
• Topics: bower, markdown, nodejs, npm, plugin, showdown
• Language: JavaScript
• Size: 53.7 KB
• Stars: 9
• Watchers: 3
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • Funding: .github/FUNDING.yml
  • License: LICENSE.txt

Awesome Lists containing this project

README

        
# Showdown HTML Escape plugin

[![npm version](https://badge.fury.io/js/showdown-htmlescape.svg)](http://badge.fury.io/js/showdown-htmlescape)

[![Bower version](https://badge.fury.io/bo/showdown-htmlescape.svg)](http://badge.fury.io/bo/showdown-htmlescape)

[![Dependency Status](https://david-dm.org/phw/showdown-htmlescape.svg)](https://david-dm.org/phw/showdown-htmlescape)

[![devDependency Status](https://david-dm.org/phw/showdown-htmlescape/dev-status.svg)](https://david-dm.org/phw/showdown-htmlescape#info=devDependencies)

[![Build Status](https://travis-ci.org/phw/showdown-htmlescape.svg?branch=master)](https://travis-ci.org/phw/showdown-htmlescape)

[![Code Climate](https://codeclimate.com/github/phw/showdown-htmlescape/badges/gpa.svg)](https://codeclimate.com/github/phw/showdown-htmlescape)

[![Test Coverage](https://codeclimate.com/github/phw/showdown-htmlescape/badges/coverage.svg)](https://codeclimate.com/github/phw/showdown-htmlescape/coverage)

This plugin for [Showdown](https://github.com/showdownjs/showdown) prevents

the use of arbitrary HTML and allows only the specific Markdown syntax.

This is useful if you want to allow your users to format text using the Markdown

syntax but you do not want them to directly enter HTML.

## Installation

### With [bower](http://bower.io/)

    bower install showdown-htmlescape

### With [npm](http://npmjs.org)

    npm install showdown-htmlescape

### Manual

You can also [download the latest release zip or tarball](https://github.com/phw/showdown-htmlescape/releases) and include the file `dist/showdown-htmlescape.js` directly in your project.

## Enabling the extension

### Browser

You have to include both Showdown and the Showdown HTML Escape extension in your

project:

```HTML

```

After including the extension in your application, you just need to enable it

for your Showdown converter:

```JavaScript

var converter = new showdown.Converter({extensions: ['htmlescape']})

```

### Node.js

```JavaScript

var showdown = require('showdown')

var showdownHtmlEscape = require('showdown-htmlescape')

var converter = new showdown.Converter({ extensions: [showdownHtmlEscape] })

```

## Usage example

```JavaScript

var converter = new showdown.Converter({extensions: ['htmlescape']})

var input = 'Allows **Markdown markup**, but does not allow HTML markup'

var html = converter.makeHtml(input)

console.log(html)

```

This should output:

```HTML

Allows Markdown markup, but does not allow <b>HTML markup</b>

```


## Notes on security

This plugin is **not** meant to protect you from XSS attacks, it justs limits

the syntax available to the user to the Markdown specific syntax. If security

and XSS prevention is important for your use case  you still must filter the

HTML generated by Showdown.

See [Markdown's XSS Vulnerability (and how to mitigate it)](https://github.com/showdownjs/showdown/wiki/Markdown's-XSS-Vulnerability-%28and-how-to-mitigate-it%29)

for details.

## License

Showdown HTML Escape Copyright © 2015-2016 Philipp Wolfer 

Published under the MIT license, see LICENSE.txt for details.