I've picked up on the work started over at https://github.com/erusev/parsedown/pull/276 and rebased on erusev/master.

Since this is rebased on master, I can't point at PR at naNuke/master without running into the merge conflicts that I've already resolved manually.

I've implemented what I suggested earlier so that all attributes are properly encoded (and not just the specific ones we remember).

I've also added some tests, so @erusev's concern here should hopefully now be resolved, albeit a year later 😉 https://github.com/erusev/parsedown/pull/276#issuecomment-178577968

@malas one reason is the lack of tests

~~One thing to note is that all this can be circumvented if you forget to turn on $Parsedown->setMarkupEscaped(true); (which is off by default) as you could just write a script tag manually for xss (even though the attributes and link destinations will be safe). So let's all remember to enable this setting 😉~~

Attributes are now always escaped properly (this speaks to just outputting things correctly), but link based XSS or XSS from writing plain old script tags will only be prevented only if the new setSafeMode is enabled.

$Parsedown->setSafeMode(true);

Closes #161 Closes #497 Closes #276 Closes #403 Closes #530

The following CVE has been assigned to the vulnerability specific to bypassing ->setMarkupEscaped(true): CVE-2018-1000162.

Parsedown offers no safe option for rendering, so, for those of us who allow no HTML content within markdown text, we must sanitize prior to feeding to Parsedown. As a result, Parsedown double encodes HTML entities (see #50).

Instead, Parsedown should offer a "safe" option.

function text($text, $safe_mode = false) {
    $this->safe_mode = $safe_mode;
    if ($safe_mode) {
        $text = htmlentities($text, ENT_QUOTES, 'UTF-8');
    }
    ...
}

Usage:

$parsedown = new ParseDown();
$text = "<script>alert('unsafe text');</script>";
echo $parsedown->text($text, true);

Output:

<script>alert(&quote;unsafe text&quote;);&lt/script>

Previewing parsedown not displaying correct newlines in preview

With <br/> manually entered texarea I do not want to have to enter <br/> all the time if need to have extra lines

Question: How can I get it to show correct lines amount of lines that are in the textarea to preview?

Controller How I load the parsedown.php

if I replace \n with <br> it will effect the code indents I have tried nl2br() also

<?php

class Example extends CI_Controller {

	public function __construct() {
		parent::__construct();
                // application > libraries > Parsedown.php
		$this->load->library('parsedown'); 
	}

	public function index()
	{
		$this->load->view('example_view');
	}

	public function preview() {
		$data['success'] = false;
		$data['output'] = '';

		if ($this->input->post('html')) {
			
			$string = str_replace('\n', '\r\n', $this->input->post('html'));
			
			$data['success'] = true;
			$data['output'] = $this->parsedown->text($string);
			
		}

		echo json_encode($data);
	}
}

Script

<script type="text/javascript">
$( document ).ready(function() {
	$('#editor').on('paste cut mouseup mousedown mouseout keydown keyup', function(){
		var postData = {
			'html' : $('#editor').val(),
		};
		$.ajax({
			type: "POST",
			url: "<?php echo base_url('example/preview');?>",
			data: postData,
			dataType: 'json',
			success: function(json){
				$('#output').html(json['output']);
			}
		});
	});
});
</script>

it's one of the best markdowns this is the only thing I can that need to fix.

Hello, I am back with the safe links issue. As always this is open to discussion :) but together with already existing markupEscaped setting, this is basically a fix for issues #161 and #210, and maybe other im not aware of.

Hi,

thanks for this great and fast MD parser :) When i used it on this MD-File: https://github.com/RexDude/seo42/blob/master/README.md

I get 6-times (EDIT: due to a REDAME.md update there are now 10) the following PHP-Warning and also all the Links won't get converted.

Warning: preg_match_all(): Compilation failed: internal error: previously-checked referenced subpattern not found at offset 37 in /home/dude/Projekte/Web/AddonFactory/htdocs/redaxo/include/addons/seo42/classes/class.parsedown.inc.php on line 494

Is this something with my MD-File or with the Parser?

I was writing a lot of tests, and then copy/pasting the HTML from my browser to the appropriate HTML file, which was very time consuming. Then it occurred to me that we could use Parsedown.php as the CLI tool. With this code you can now do:

php Parsedown.php document.md > document.html

When parsing HTML inside my Markdown string, I've been coming across some issues. Most noticeably any href attributes of those HTML bits.

<a z='/training/schema' href='/training/schema'>Schema</a>

Is rendered as

<a z="/training/schema" href="%7B%7B%20url%20%7D%7D">Schema</a>

I would like to remove the <p></p> englobing the html output as it has not specifically been asked.

Just make an optional parameter to remove it in parse

$parser = new Parsedown();
$output = $parser->parse($input,false);//Without <p></p>
$output = $parser->parse($input,true);//With <p></p>
$output = $parser->parse($input);//With <p></p>

Thanks

This is more or less how GitHub Flavored Markdown works.

See an example: https://github.com/henriquemoody/parsedown/blob/titles/test/data/atx_heading.md

Best regards...

The problem I have is the following: When creating paragraphs with appointments, the next paragraph that does not belong to the appointment is added. In this way:

Well I am using this lib in my chat app and the problem I am facing is formatting sanitized inputs.

For ex: If the user sends > text it doesn't change to blockquote but shows up as > text where > is the html entity code in the html inspector and also in the db.

Is there any way it could be done to get it to work as expected?

Hi,

Thanks for this great project! Iam using this in https://github.com/secure-77/Perlite

I have a question about blockquotes and nested html elements on the same level.

I want to transform this:

> [!bug]
> Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur et gravida diam, et varius magna. Proin `id felis quis nisl` gravida auctor a eu est. In viverra dui viverra placerat cursus. Curabitur non commodo mi. Mauris volutpat nisl vitae nulla efficitur condimentum. Nulla facilisi. Maecenas malesuada purus mi, eget fringilla quam ultrices sit amet.

to something like this

	<div data-callout="bug" class="callout">
		<div class="callout-title">
			<div class="callout-title-inner">Bug</div>
		</div>
		<div class="callout-content">
			<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur et gravida diam, et varius magna. Proin <code>id felis quis nisl</code> gravida auctor a eu est. In viverra dui viverra placerat cursus. Curabitur non commodo mi. Mauris volutpat nisl vitae nulla efficitur condimentum. Nulla facilisi. Maecenas malesuada purus mi, eget fringilla quam ultrices sit amet.</p>
		</div>
	</div>

So far, I have extended the blockQuotes function to handle callouts

protected function blockQuote($Line)
    {

        if (preg_match('/^>[ ]?(.*)/', $Line['text'], $matches)) {
            $Block = array(
                'element' => array(
                    'name' => 'blockquote',
                    'handler' => 'lines',
                    'text' => (array) $matches[1],
                ),
            );
            

        if (preg_match('/^>\s?\[\!(.*?)\](.*?)$/m', $Line['text'], $matches)) {
            $type = strtolower($matches[1]);
            $title = $matches[2];

            $calloutTitle = $title ?: ucfirst($type);


            $Block = array(
                'element' => array(
                    'name' => 'div',
                    'attributes' => array(
                        'data-callout' => $type,
                        'class' => 'callout'
                    ),
                    'handler' => 'lines',
                    'text' => (array) $calloutTitle,
                ),
            );
        }
    }


        return $Block;
    }

this is my current output.

<div data-callout="info" class="callout">
<p>Info<br>
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur et gravida diam, et varius magna. Proin <code>id felis quis nisl</code> gravida auctor a eu est. In viverra dui viverra placerat cursus. Curabitur non commodo mi. Mauris volutpat nisl vitae nulla efficitur condimentum. Nulla facilisi. Maecenas malesuada purus mi, eget fringilla quam ultrices sit amet.</p>
</div>

But I cant figure out how to create a structure like this

<div data-callout="bug" class="callout">
		<div class="callout-title">Title</div>
		<div class="callout-content">Text</div>
</div>

I've tried a few things but I don't know how to make this work. Thanks for any advice!

Description

Parsedown splits a code block in multiple parts when having a markdown file like the following:

* Source
```bash
$ ls

# Comment in code
$ ls
```

The issue is present in the latest stable release and the latest public beta.

Expected Behavior

<ul>
<li>Source</li>
</ul>
<pre><code class="language-bash">$ ls
# Comment in code</span>

$ ls
</code></pre>

Actual Behavior

<ul>
<li>Source
<pre><code class="language-bash">$ ls
</code></pre>
</li>
</ul>
<h1>Comment in code</h1>
<p>$ ls</p>
<pre><code></code></pre>

Steps to reproduce

Reproduce with Parsedown 1.7.4

• Go to Parsedown Demo
• Add markdown example from the description
• Click parse

Reproduce with Parsedown 2.0.0 Beta 1

Setup

$ sudo apt install php8.1
$ php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
$ php composer-setup.php
$ php -r "unlink('composer-setup.php');"
# Dependencies
$ sudo apt-get install php8.1-mbstring
$ php ../composer.phar require erusev/parsedown:v2.0.0-beta-1
$ php demo.php

demo.php

<?php

require __DIR__ . '/vendor/autoload.php';

use Erusev\Parsedown\Configurables\Breaks;
use Erusev\Parsedown\Configurables\SafeMode;
use Erusev\Parsedown\Configurables\StrictMode;
use Erusev\Parsedown\State;
use Erusev\Parsedown\Parsedown;


$markdown = <<<EOD
* Source
```bash
$ ls

# Comment in code
$ ls
```
EOD;


$state = new State([
    new Breaks(true),
    new SafeMode(true),
    new StrictMode(false)
]);

$Parsedown = new Parsedown($state);
echo $Parsedown->toHtml($markdown);
?>

Description

Parsedown places the h1 element inside the list element when having a markdown file like the following:

* element1
* element2
# Troubleshooting

The issue is present for the latest stable release and the latest public beta. The problem does not occur with Markdown PHP 1.3 featured in the Parsedown Demo though.

Let me know how I can further assist @erusev @aidantwoods.

Expected Behavior

<ul>
<li>element1</li>
<li>element2</li>
</ul>

<h1>Troubleshooting</h1>

Actual Behavior

<ul>
<li>element1</li>
<li>element2
<h1>Troubleshooting</h1></li>
</ul>

Steps to reproduce

Reproduce with Parsedown 1.7.4

• Go to Parsedown Demo
• Add markdown example from the description
• Click parse

Reproduce with Parsedown 2.0.0 Beta 1

Setup

$ sudo apt install php8.1
$ php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
$ php composer-setup.php
$ php -r "unlink('composer-setup.php');"
# Dependencies
$ sudo apt-get install php8.1-mbstring
$ php ../composer.phar require erusev/parsedown:v2.0.0-beta-1
$ php demo.php

demo.php

<?php

require __DIR__ . '/vendor/autoload.php';

use Erusev\Parsedown\Configurables\Breaks;
use Erusev\Parsedown\Configurables\SafeMode;
use Erusev\Parsedown\Configurables\StrictMode;
use Erusev\Parsedown\State;
use Erusev\Parsedown\Parsedown;


$markdown = <<<EOD
* element1
* element2
# Troubleshooting
EOD;


$state = new State([
    new Breaks(true),
    new SafeMode(true),
    new StrictMode(false)
]);

$Parsedown = new Parsedown($state);
echo $Parsedown->toHtml($markdown);
?>

Add a new option to define the minimal Header level to be used e.g. if the option ->minHeaderLevel(3) a header defined with a single hash # heading will be parsed as <h3>heading</h3>