angular-marked icon indicating copy to clipboard operation
angular-marked copied to clipboard

Published 20 hours ago • verified publisher icon Hypercubed

Overriding link renderer skips all the security work made by the default renderer

Open nadouani opened this issue 7 years ago • 0 comments

Hello,

The following example (from repo's Readme) overrides the link renderer that is making a lot of escaping and sanitization work to avoid XSS issues.

app.config(['markedProvider', function (markedProvider) {
  markedProvider.setRenderer({
    link: function(href, title, text) {
      return "<a href='" + href + "'" + (title ? " title='" + title + "'" : '') + " target='_blank'>" + text + "</a>";
    }
  });
}]);

I don't find a way to customize the renderer by invoking the original link renderer of marked library.

Thanks

nadouani avatar Sep 18 '18 12:09 nadouani