sausagewiki Fix handling of inline HTML

Currently pulldown-cmark parses inline HTML as HTML (in adherence to the CommonMark spec). Sausagewiki takes this HTML and reframes it as text, because inline HTML is weird.

Instead, the parser should be configured not to look for HTML in the input.

Oct 26 '17 11:10 maghoff

Forked and fixed in pulldown-cmark: https://github.com/maghoff/pulldown-cmark

Upstream pull request: https://github.com/google/pulldown-cmark/pull/103

Oct 28 '17 10:10 maghoff

See https://github.com/maghoff/sausagewiki/compare/proper_html_handling for relevant local changes

Oct 28 '17 15:10 maghoff

This has now been merged to master, so master depends on this fork: https://github.com/maghoff/pulldown-cmark

Keeping this issue open to track upstream development.

Nov 29 '17 21:11 maghoff

Why are you trying to block inline HTML, instead of using a sanitizer pass like GitHub does?

Inline HTML is a part of the CommonMark spec. If you allow none of it, then you're not compliant.
CommonMark doesn't include all of the markup types that you probably want. For example, <del>strike through</del>
pulldown-cmark is not designed to filter any untrusted data. In particular, it does nothing about untrusted URL schemes.

I kinda wrote an HTML sanitization library specifically because I have strong opinions on this matter:

Nov 30 '17 18:11 notriddle

Are at least  comments supported or also removed?

Dec 01 '17 20:12 vi

@notriddle Thank you for bringing the security issue to my attention. The choice of markup language for the wiki is merely one of many design descisions that have gone into making Sausagewiki what it is. I find Markdown without HTML to be a good, simple markup language, while I do not find the same for Markdown with HTML. Simplicity has been a goal all along, Commonmark conformance not a goal. The alternative for Sausagewiki would not be Markdown with HTML, but rather another simple language altogether.

@vi You could try and see? ☺

Dec 02 '17 12:12 maghoff