如何防止 Showdown 删除脚本标签？

Question

I was testing out something and tried to put this into Showdown:

<script>alert("hacked!");</script>

Of course it didn't alert anything (Showdown is made to protect against those sorts of things), but the <script> tag gets removed completely. I am using this for a user description, so the script tag (and it's contents) should be visible, just not executed.

I was thinking that most likely I would need to change some built in Showdown code but couldn't find any place in it's code that I should change to only show the script tags but not execute them.

Does anyone know any existing options or some changes to the source code to show this?

Answer 1

I found this place in the code and it is responsible for hashing HTML tags such as: <script> or </script> .

https://github.com/showdownjs/showdown/blob/a9f38b6f057284460d6447371f3dc5dea999c0a6/src/subParsers/makehtml/hashHTMLBlocks.js

I think you should only delete lines 329 in the file

https://github.com/showdownjs/showdown/blob/a9f38b6f057284460d6447371f3dc5dea999c0a6/src/converter.js

And everything should work.

Answer 2

I found the answer: I just needed to replace the start and end of the <script> tags with something visible, like <script and </script>

This is the code I used:

myshowdownhtml.split("<script").join("&lt;script").split("<"+"/script>").join("&lt;/script&gt;");