Detect HTML/JS injection attacks and warn users pro-actively

Is your request related to a specific problem you’re having?

https://github.com/highlightjs/highlight.js/issues/2884 https://github.com/ccampbell/rainbow/issues/249

This comes up again and again (though thankfully not TOO often). Beginners are VERY confused about this whole HTML escaping thing.

The solution you’d prefer / feature you’d like to see added…

While we can’t do anything smart about this yet (because we unfortunately allow HTML inside code blocks for “clever” users) I’d like this to change with v11. With v11 we should drop this HTML pass-thru behavior and move it to a plugin (making it very much opt-in). The default behavior should be that HTML is silently dropped and I’d even consider adding some sort of error:

[code block]
WARNING.
Are you missing a bunch of HTML code you expected to see here? 
Your HTML wasn't properly escaped and that can lead to serious
security issues. _Learn More_

Properly escape your code and the highlighting you expect will kick in.
[/code block]

This would of course be a breaking change so we’d need to wait until v11. For 95% of users I can’t see the downside to this and it seems we could potentially educate and prevent a lot of harm. Someone wanting the HTML to pass thru would install a plug-in and thus change the behavior, get the old behavior back, etc.

Any alternative solutions you considered…

Silent dropping but no error… but that just leads to support issues… I suppose we could log the error to the console vs actually showing it on the webpage.

[voracious]

@FractalHQ make sure you know what you’re doing (regarding sanitization), and then use this config option.

hljs.configure({ ignoreUnescapedHTML: true })

[joshgoebel]

Your very first snippet has embedded unescaped HTML - two hyperlinks. We have no way to know if that might be malicious code or not - code blocks are expected to contain only text, not HTML. If you know for sure you can disable the warning (see documentation), but those hyperlinks will still be removed - we do not process HTML by default any longer.

If you need the HTML to be preserved you should see the issue on this subject and may need to use a plugin now: https://github.com/highlightjs/highlight.js/issues/2889