wmd editor sanitizing
- by Ke
hi,
i am trying to find ways to sanitize the input of wmd editor
Specifically, I am trying to make HTML tags only available in the <code>tags that wmd generates. Is that possible
My problem is that the following code is rendered as html which is vunerable to potential xss attacks
e.g. <a onmouseover="alert(1)" href="#">read this!</a>
The above code renders normally both in preview mode and when saved to the db.
I notice that SO doesnt seem to have this problem. The same code is just rendered as text.
I notice that SO has shared their code here http://refactormycode.com/codes/333-sanitize-html
Do I really have to use c# in order to sanitize wmd to do this?
Any help appreciated , cheers Ke