Skip to main content

sanitizeMarkdown

@webda/core

Function: sanitizeMarkdown()

sanitizeMarkdown(value): Promise<string>

Defined in: packages/core/src/contexts/sanitize.ts:257

Sanitize a Markdown source (CommonMark, as parsed by micromark)

The source is kept as written (&, >, code spans and code blocks are untouched), except what a renderer would pass through as active content:

  • raw HTML, block or inline: every < of it is replaced by &lt;;
  • an autolink (<scheme:...>) with an unsafe scheme: its < is replaced by &lt;;
  • the destination of a link, an image or a reference definition with an unsafe scheme: replaced by #.

A scheme is unsafe when it is not http, https, mailto or tel; relative URLs and anchors are kept. The result is parsed again until nothing is left to neutralize; a text that does not settle is sanitized like text, and its links and reference definitions are escaped (]\(, ]\:).

This is defense in depth: the renderer must still not enable raw HTML, or must sanitize its output. It does not cover MDX, nor syntax extensions that give other constructs a meaning.

Parameters​

value​

string

the Markdown source

Returns​

Promise<string>

the sanitized source

Throws​

SanitizerUnavailable when micromark or micromark-util-decode-string is not installed