Skip to content

Provide a CMARK_UNSAFE environment variable for backwards compatibility. #344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Provide a CMARK_UNSAFE environment variable for backwards compatibility. #344

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,12 +158,20 @@ Security

By default, the library will scrub raw HTML and potentially
dangerous links (`javascript:`, `vbscript:`, `data:`, `file:`).
This behaviour change was introduced in the 0.29.0 release.

To allow these, use the option `CMARK_OPT_UNSAFE` (or
`--unsafe`) with the command line program. If doing so, we
recommend you use a HTML sanitizer specific to your needs to
protect against [XSS
attacks](http://en.wikipedia.org/wiki/Cross-site_scripting).
In the API, you can use the option `CMARK_OPT_UNSAFE` to disable it.

When calling the `cmark` command line program, you can disable it
with `--unsafe` option.

You can also disable it by setting the `CMARK_UNSAFE` environment variable.
If you want a script to work with both older and newer versions,
you can use `CMARK_UNSAFE=1 cmark` command.

If your Markdown files come from an untrusted source,
we recommend that you use an HTML sanitizer
to prevent [XSS attacks](http://en.wikipedia.org/wiki/Cross-site_scripting).

Contributing
------------
Expand Down
5 changes: 5 additions & 0 deletions src/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,11 @@ int main(int argc, char *argv[]) {
}
}

char* unsafe_env_var = getenv("CMARK_UNSAFE");
if (unsafe_env_var != NULL) {
options |= CMARK_OPT_UNSAFE;
}

parser = cmark_parser_new(options);
for (i = 0; i < numfps; i++) {
FILE *fp = fopen(argv[files[i]], "rb");
Expand Down