humanonlyweb/writer

Security

Content is untrusted.

Markdown

  • Raw HTML is text.

  • Only Markdown's own elements and registered blocks render. App-wide components can't be reached from Markdown.

  • script, style, iframe, object and similar are removed, with their content. So are on* handlers, style attributes (except a highlighter's colours inside code) and URLs that aren't relative, http(s), mailto or tel.

  • <WriterContent> sanitizes again before rendering, so a stored document is safe even if it didn't come from this parser.

The checks are exported from @humanonlyweb/writer/parse: sanitize(nodes, isAllowed?), isSafeUrl(url) and NATIVE_TAGS.

What's left to you

  • Authors can set class and id with {…}. With untrusted authors and utility-class CSS (fixed inset-0), that's enough to restyle the page: strip them from parsed documents, or render those elements through components.

  • Blocks get attributes as written. Validate any URL your block puts in an attribute other than href or src.

  • CodeMirror injects <style> elements. Under a strict CSP, pass EditorView.cspNonce.of(nonce) in extensions.