GUIDE深度 · Deep dive
XSS Risks in Markdown Rendering
Markdown can contain raw HTML and links. Putting user input directly into innerHTML can execute scripts or navigate to javascript:. Escape first and render with an allowlist.
Two entry points
Raw HTML: <script>, onerror= and similar.
Link protocols: javascript:, data: and similar.
Defenses
Escape input first; generate only allowlisted tags.
Allow only http(s), mailto and relative links; add CSP and a sanitizer.
FAQ
Is escaping enough?
For plain text yes; rich text needs a sanitizer and CSP.
Does the server need to handle it too?
Yes; every layer that writes HTML must handle its context.