Answer the question
In order to leave comments, you need to log in
VOLT, Phalcon, XSS how to fix?
An example for everyone.
In general, I do not know what crutch to come up with here. Problem:
I'm outputting a post. But before the output, I run the post through the XSS filter built into VOLT: {{ post.message|e }}
But the point is that post.message has MarkDown markup. Which needs to be converted to valid HTML.
The first option is what I do: {{ mark.Down(post.message) }}
But this way you can shove XSS.
I decided to run through the XSS filter before passing post.message to the markDown::parse() function:
{% set post.message = post.message|e %}
<div class="post-text">
{{ markDown.parse(post.message) }}
</div>
<?php $post->message = $this->escaper->escapeHtml($post->message); ?>
<div class="post-text">
<?php echo $this->markDown->parse($post->message); ?></p>
</div>
Answer the question
In order to leave comments, you need to log in
How is markDown initiated? What is it?
And so it works?
{% set post_message = post.message|e %} {# не портить внутренности объекта post #}
<div class="post-text">
{{ markDown.parse(post_message ) }}
</div>
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question