Allow presentational HTML with Markdown like GitHub

[sizzlemctwizzle]

@OpenUserJs/admin @OpenUserJs/backend
I've made an experimental patch to the library we use for Markdown (marked) that allows some presentational HTML like you find on GitHub (see here for details).

I've added a branch to OpenUserJS.org that uses the modified library. You'll need to install the new library: npm install marked-whitelist-html

Please test it, try to find ways to break it, and do generally bad things so that it can be fixed and made secure. Thanks.

[Martii]

You'll need to install the new library: npm install marked-whitelist-html

Checking out a detached HEAD from an upstream tracking branch usually works for me... then in that folder I just type $ npm install which checks the current ./package.json file and downloads whatever is needed for the dev run. This is how I did it with the current UI branch.

I'll need a few days to get back to this since the beginning of each month is my most busiest... but I'm looking forward to trying it out when I can. :)

[sizzlemctwizzle]

then in that folder I just type $ npm install which checks the current ./package.json file and downloads whatever is needed for the dev run.

I had no idea you could do this. Thanks for the knowledge.

I'll need a few days to get back to this

Totally understandable. I didn't think this would be a quick change. I'm trying to modify a well written library and expect mistakes. Take as much time as you need to test my change.

[jerone]

You might want to give xss.js a try. It contains the whitelist you copied and more, especially the elements only allowed within a table.

[sizzlemctwizzle]

Thank you so much for pointing out that library @jerone. It works great and I'm happy I don't have develop and maintain my own fork.

[Martii]

Uhmmm somethings wrong with markdown now and I haven't changed a thing. See this homepage.

[Zren]

Pretty sure xss sanitizes HTML, not Markdown. You probably want to reverse return marked(xss(text)); with return xss(marked(text));

[sizzlemctwizzle]

You probably want to reverse

Thanks. Hopefully that fixes things.

[sizzlemctwizzle]

@Zren Since you're the one basically redoing the entire style of the site, do you mind giving anchor links a background image (icon) like GitHub so people can actually see and copy the url?