Issue With Filtering HTML

[obedm503]

Issue With Filtering HTML

[obedm503]

It's difficult to understand what's going on. Can you give a file or repo that reproduces and explains the issue?

[AkinOlawale]

It's difficult to understand what's going on. Can you give a file or repo that reproduces and explains the issue?

Okay. My bad. I'll explain properly.

I'm using showdown library via the browser as

const converter = new showdown.Converter();

Then I call filterXSS(converter.makeHtml(htmlStuff));

The filterXSS() function comes from <script src="https://rawgit.com/leizongmin/js-xss/master/dist/xss.js"></script>

The above steps work without integrating your library

But when I integrate with your library via the extension parameter as:

converter = new showdown.Converter({
                extensions: [
                    showdownKatex({                        
                        throwOnError: true,                        
                        displayMode: false,                        
                        errorColor: '#1500ff',                        
                    })
                ]
            });
            html = converter.makeHtml(string);
            target_div_id.innerHTML = filterXSS(html);

Things break.

From my debug attempt, the filterXSS() strips away the HTML.
When I remove filterXSS(), it works perfectly.

Is there anyway to filter the output without losing the result?

[obedm503]

That seems counter-productive. I imagine filterXSS is mean to convert html characters to html entities (<script> -> <script>) or "make the html safe". It seems like filterXSS is doing exactly what it's supposed to.

Is there anyway to filter the output without losing the result?

That seems like a question for leizongmin/js-xss