diff --git a/CHANGELOG.md b/CHANGELOG.md index e4c7f49..ba9839a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Added - `inputStyle` and `nativeSpellcheck` options to manage the native language of the browser (Thanks to [@firm1], [#143]). +- `sanitizerFunction` option to allow custom HTML sanitizing in the markdown preview (Thanks to [@adamb70], [#147]). ### Changed - Delay before assuming that submit of the form as failed is `autosave.submit_delay` instead of `autosave.delay` (Thanks to [@Situphen], [#139]). - Add `watch` task for gulp. diff --git a/README.md b/README.md index b68caba..01a1ef5 100644 --- a/README.md +++ b/README.md @@ -178,6 +178,7 @@ easyMDE.value('New input for **EasyMDE**'); - **hljs**: An injectible instance of [highlight.js](https://github.com/isagalaev/highlight.js). If you don't want to rely on the global namespace (`window.hljs`), you can provide an instance here. Defaults to `undefined`. - **markedOptions**: Set the internal Markdown renderer's [options](https://marked.js.org/#/USING_ADVANCED.md#options). Other `renderingConfig` options will take precedence. - **singleLineBreaks**: If set to `false`, disable parsing GFM single line breaks. Defaults to `true`. + - **sanitizerFunction**: Custom function for sanitizing the HTML output of markdown renderer. - **shortcuts**: Keyboard shortcuts associated with this instance. Defaults to the [array of shortcuts](#keyboard-shortcuts). - **showIcons**: An array of icon names to show. Can be used to show specific icons hidden by default without completely customizing the toolbar. - **spellChecker**: If set to `false`, disable the spell checker. Defaults to `true`. @@ -251,6 +252,10 @@ var editor = new EasyMDE({ renderingConfig: { singleLineBreaks: false, codeSyntaxHighlighting: true, + sanitizerFunction: function(renderedHTML) { + // Using DOMPurify and only allowing tags + return DOMPurify.sanitize(renderedHTML, {ALLOWED_TAGS: ['b']}) + }, }, shortcuts: { drawTable: "Cmd-Alt-T" diff --git a/src/js/easymde.js b/src/js/easymde.js index 4e0a2f6..5e4d8ce 100644 --- a/src/js/easymde.js +++ b/src/js/easymde.js @@ -1762,6 +1762,11 @@ EasyMDE.prototype.markdown = function (text) { // Convert the markdown to HTML var htmlText = marked(text); + + // Sanitize HTML + if (this.options.renderingConfig && typeof this.options.renderingConfig.sanitizerFunction === 'function') { + htmlText = this.options.renderingConfig.sanitizerFunction.call(this, htmlText); + } // Edit the HTML anchors to add 'target="_blank"' by default. htmlText = addAnchorTargetBlank(htmlText);