Make cmark safe by default

[Hultner]

@kivikakk have changed the default behaviour in cmark-gfm to be safe by default.
github#123

This is the result of a library I created earlier this week as a response to the large number of XSS-exploits found in the wild the past year or so. Hence I wanted to provide a safe by default library wrapping cmark-gfm.
https://github.com/Hultner/safemd

Getting this changed upstream in cmark-gfm was a much greater success than I ever expected from my project and the natural next steps would be to lift it all the way up to cmark.

My suggestion is that we implement similar changes into cmark so you have to be explicitly unsafe instead of implicit unsafe.

I am a strong believer safe by default and hope you'll consider my concerns.

[fingolfin]

Isn't this a duplicate of #239?

[Hultner]

@fingolfin Yep looks like it, didn’t find that one when I posted this.

However I do think we should reconsider allowing a safe subset of html per default since evidently a lot of consumers will just rely on the default behaviour unknowingly exposing themselves (and their users) for unnecessary risk.

From my point of view it’s almost always better to be explicit about unsafe behaviour then the opposite.

[jgm]

This is the reference implementation for commonmark.
So, I think it makes sense for the default to pass through raw HTML, since that's part of the commonmark spec.
Otherwise the default behavior doesn't conform to the spec and won't pass the automatic tests.

[jgm]

Closing as duplicate, but still considering this.