redmine/redmine — pull request #28 by charmander (2014-02-13 02:31:19+00:00)
Title: Added proper HTML scrubbing to Markdown renderer

The current renderer strips HTML (contrary to conventional Markdown) and still fails to catch everything:

```markdown
[bad link](javascript:alert(1\))
```

This fixes both behaviours. See also [scrub-classes] for a patch to remove unrecognized classes that could potentially be used to annoy; I haven’t included it here (nor completed the list) because the existing implementation already allows all classes through syntax highlighting:

~~~any-class-here
code block
~~~

[scrub-classes]: https://github.com/charmander/redmine/tree/scrub-classes