@intcreator/markdown-element - npm Package Compare versions

Comparing version 0.3.0 to 0.3.1

markdown-element.js

@@ -37,2 +37,5 @@ import { LitElement, html } from '@polymer/lit-element/lit-element.js';
                 type: String
+            },
+            safe: {
+                type: Boolean
             }
@@ -87,3 +90,3 @@ };
         const reader = new commonmark.Parser();
-        const writer = new commonmark.HtmlRenderer();
+        const writer = new commonmark.HtmlRenderer({ safe: this.safe });
         // assuming commmonmark library will properly sanitize code
@@ -90,0 +93,0 @@ return html`${unsafeHTML(writer.render(reader.parse(markdown)))}`;

package.json

 {
   "description": "A Markdown renderer that uses the Commonmark spec",
   "name": "@intcreator/markdown-element",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "author": "Brandon der Blätter (https://intcreator.com)",
@@ -6,0 +6,0 @@ "main": "markdown-element.js",

README.md

@@ -49,2 +49,16 @@ # <markdown-element>
 
+## Properties
+
+### `safe`
+
+Use the `safe` property if you are accepting user input that cannot be trusted (to prevent [XSS attacks](https://en.wikipedia.org/wiki/Cross-site_scripting)).  This will prevent raw HTML and links beginning in `javascript:`, `vbscript:`, etc. from being rendered.  For more details, see the [Commonmark.js README](https://github.com/commonmark/commonmark.js#usage) explanation of `safe`.
+
+```html
+<markdown-element safe>
+    <script type="text/markdown">
+        This <button onclick="alert('JavaScript executed')">button</button> is evil
+    </script>
+</markdown-element>
+```
+
 ## Roadmap to 1.0
@@ -51,0 +65,0 @@

No alert changes

Improved metrics

Total package byte prevSize

12743

10.78%

Lines of code

88

3.53%

Number of lines in readme file

72

24.14%

No dependency changes