lruiz/MarkdownPapers — Issue #21: Is there a recommended way to prevent JS injection on user generated content?
Author: Fluor
Created: 2012-02-29 07:36:01+00:00
State: open

Hi,

We are using MardownPapers through [Markdown Play! module](/orefalo/markdown) for user generated content : user are able to fill in their profile with Markdown enabled content.

MarkdownPapers does not prevent JavaScript injection (and it might not be its job to do it).
For exemple, the following Markdown content produces working HTML and JavaScript :

Hover with your mouse

Is there a recommended workaround to prevent JavaScript injection?