Sanitize markdown output

getformwork · Jun 15, 2024 · 6ddbbd3 · 6ddbbd3
1 parent abaa220
commit 6ddbbd3
Showing 1 changed file with 9 additions and 7 deletions.
diff --git a/formwork/src/Parsers/Markdown.php b/formwork/src/Parsers/Markdown.php
@@ -4,9 +4,9 @@
 
 use Formwork\App;
 use Formwork\Parsers\Extensions\CommonMark\LinkBaseExtension;
+use Formwork\Sanitizer\HtmlSanitizer;
 use League\CommonMark\Environment\Environment;
 use League\CommonMark\Extension\CommonMark\CommonMarkCoreExtension;
-use League\CommonMark\Extension\DisallowedRawHtml\DisallowedRawHtmlExtension;
 use League\CommonMark\Extension\Table\TableExtension;
 use League\CommonMark\MarkdownConverter;
 
@@ -22,19 +22,21 @@ public static function parse(string $input, array $options = []): string
         $safeMode = App::instance()->config()->get('system.content.safeMode', true);
 
         $environment = new Environment([
-            'html_input'         => $safeMode ? 'escape' : 'allow',
-            'allow_unsafe_links' => false,
-            'max_nesting_level'  => 10,
-            'formwork'           => $options,
+            'html_input'        => $safeMode ? 'escape' : 'allow',
+            'max_nesting_level' => 10,
+            'formwork'          => $options,
         ]);
 
         $environment->addExtension(new CommonMarkCoreExtension());
         $environment->addExtension(new TableExtension());
         $environment->addExtension(new LinkBaseExtension());
-        $environment->addExtension(new DisallowedRawHtmlExtension());
 
         $markdownConverter = new MarkdownConverter($environment);
 
-        return $markdownConverter->convert($input);
+        $html = $markdownConverter->convert($input);
+
+        $htmlSanitizer = new HtmlSanitizer();
+
+        return $htmlSanitizer->sanitize($html);
     }
 }