CODEWITHSUNDEEP
htmlmarkdown
usr
usr

Reputation: 171178

Markdown.NET incorrectly does not escape HTML-Tags

it seems that Markdown.NET does not escape the following:

<script>

which is kind of a problem...

Is there any other way of generating HTML from Markdown on the server with ASP.NET?

Upvotes: 2

Views: 494

Answers (1)

Aaron Maenpaa
Aaron Maenpaa

Reputation: 122850

Markdown explicitly allows HTML markup so: "... incorrectly does not escape ..." is not quite right.

Which means that you're on the hook for sanitizing it yourself. You could even use Stack Overflow's HTML sanitizer if you wanted to.

Upvotes: 1

Related Questions