-
Notifications
You must be signed in to change notification settings - Fork 561
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Checkboxes support #681
Comments
same bug on windows 7 |
how can you create checkboxes? I'm typing [_] but it doesn't work |
new note
|
thanks, but it doesn't work. shows me this in preview: |
It actually does work but it has a bug. Let me elaborate:
Somehow step 3 does not happen and instead you only see the html text and not the checkbox that you are supposed to |
One thing that'd be cool is if the 'preview' tab was interactive, so you could check the checkbox and when you went back to the 'edit' tab the checkbox'd be checked |
Moving this into #314 where the feature request has been being tracked. For the benefit of those in this thread I'll try and summarize why this isn't in yet:
|
See #681 See #694 See #721 The `showdown-xss` library wasn't really doing for us what we wanted. It was transforming our checkbox inputs and making them display as plain text instead of as actual HTML. In this patch I've removed `showdown-xss` and created a new centralized function to render HTML which calls our custom sanitization. Why do it ourselves? We don't need the kind of sanitiation which only removes the malicious code and leaves as much as it can untouched. Instead we are free here to strip out basically everything except for a few white-listed tags and attributes since we ourselves are the ones producing the output; we don't have to support full HTML in the notes. This patch should guard against everything on the OWASP list of XSS attacks. It will remove significant styling and custom HTML but when a tag is removed it will usually just take out the tag itself and leave the inner content as plain text. Some tags are "forbidden" and all their children are removed with them.
See #681 See #694 See #721 The `showdown-xss` library wasn't really doing for us what we wanted. It was transforming our checkbox inputs and making them display as plain text instead of as actual HTML. In this patch I've removed `showdown-xss` and created a new centralized function to render HTML which calls our custom sanitization. Why do it ourselves? We don't need the kind of sanitiation which only removes the malicious code and leaves as much as it can untouched. Instead we are free here to strip out basically everything except for a few white-listed tags and attributes since we ourselves are the ones producing the output; we don't have to support full HTML in the notes. This patch should guard against everything on the OWASP list of XSS attacks. It will remove significant styling and custom HTML but when a tag is removed it will usually just take out the tag itself and leave the inner content as plain text. Some tags are "forbidden" and all their children are removed with them.
* XSS Refactor: Replace `showdown-xss` with in-house sanitizer See #681 See #694 See #721 The `showdown-xss` library wasn't really doing for us what we wanted. It was transforming our checkbox inputs and making them display as plain text instead of as actual HTML. In this patch I've removed `showdown-xss` and created a new centralized function to render HTML which calls our custom sanitization. Why do it ourselves? We don't need the kind of sanitiation which only removes the malicious code and leaves as much as it can untouched. Instead we are free here to strip out basically everything except for a few white-listed tags and attributes since we ourselves are the ones producing the output; we don't have to support full HTML in the notes. This patch should guard against everything on the OWASP list of XSS attacks. It will remove significant styling and custom HTML but when a tag is removed it will usually just take out the tag itself and leave the inner content as plain text. Some tags are "forbidden" and all their children are removed with them. * also allow email links
I was under the impression that this was already submitted in the repository and would be included in the 1.1.0 update yet when i try to show a check box i only get this (image attached)
Steps to reproduce
What I expected
When writing check box list when pressing preview to render them properly
What happened instead
The check boxes were rendered as the equivalent HTML text for check boxes (see picture)
OS version
Ubuntu 17.10
Screenshot / Video
The text was updated successfully, but these errors were encountered: