Web Security · Middle · Question 8 of 75
Your app renders user-written Markdown to HTML. What must happen before inserting the result into the page?
- 1Only remove line breaks
- 2Nothing: Markdown can't contain HTML
- ✓Correct answer: Sanitize the generated HTML, because most Markdown renderers allow raw HTML and
javascript:links
Explanation
Markdown is a superset that often passes HTML through. Disable raw HTML in the renderer and run the output through a sanitizer.