Another Gold Brick in the Wall

1. Another Gold Brick in the Wall

   #1

   Hmm, API that takes a submission written in markdown and renders it as nice HTML.
   
   Was thinking an offline submission authorship app would be nice.
   

2. Re: Another Gold Brick in the Wall

   #2

   Opens us up for injection techniques though
   

   
   Hmm, API that takes a submission written in markdown and renders it as nice HTML.
   
   Was thinking an offline submission authorship app would be nice.
   
   

3. Re: Another Gold Brick in the Wall

   #3

   Well, sanitize the input of course - links could only be to Strolen.com for example.
   

4. Re: Another Gold Brick in the Wall

   #4

   Submit in Markdown? Yes, please!

5. Re: Another Gold Brick in the Wall

   #5

   Markdown...really?
   
   Well, it would actually be quite easy. Just add a check if markdown and it would render it I suppose....but why?

6. Re: Another Gold Brick in the Wall

   #6

   Hook for additional tools in the future.  Google doc is nice, but it stutters.  Word - sucks.
   
   With markdown, I can edit even on my ipad decently.  Easier to *something* then select some text, and click a couple of icons to bold it.
   
   Also, again only a little improvement, but instead of BBcode or html within the sub area itself, you could do basic formatting without touching the mouse.
   
   
   
   
   
   
   
   
   
   

7. Re: Another Gold Brick in the Wall

   #7

   Alright, as long as people realize that there are a gazillion ways to bypass such filters, fine with me. From a security perspective the risks far outweighs the rewards though.
   
   Basically a high risk feature which is "nice to have, but would rarely be used".
   
   

   
   Well, sanitize the input of course - links could only be to Strolen.com for example.
   
   

8. Re: Another Gold Brick in the Wall

   #8

   From a technical basis, if there are no link structures allowed, what security hole is opened? 
   
   I agree it is in the 'nice to have' category.
   
   
   
   

9. Re: Another Gold Brick in the Wall

   #9

   XSS. What we are going for here is markdown which can be rendered to HTML. XSS is a danger in any input field, moreso in an input field meant to be rendered into code.

10. Re: Another Gold Brick in the Wall

    #10

    So you sanitize any html within the markdown before saving it, then render the markdown with a whitelist. Kinda hard to setup XSS if your script tags get eaten by the sanitizer. That's kinda the point of using them.

11. Re: Another Gold Brick in the Wall

    #11

    Regardless, threw in a ton of preg_replace like the bbcode (which I updated as well) so you should be able to use some markdown.
    
    Seeing if it works will be the true test.
    
    Reminder: the editor is NOT a markdown editor. Just allowing the ability to paste markdown into it and submit it. It WILL be turned into HTML permanently after submission.
    

Strolenati Council - The Invasion of 5.0 · All categories · Guildhall