@ngamer01
Did you understand my post? I wrote:
Can't embed HTML code with Markdowns code-block feature
The Markdown code-block feature escapes securly HTML.
HTML has to be restricted or these forums risk abuse from outside vectors
< irony > OMG! Yes, HTML is bad, bad unsecure Markup, not the browsers 😉 < /irony >
Is <script>alert(42)</script> a risk?
No, because, this is not executable by browsers!
Is <link src="bad.js">alert(42)</link> unsecure?
No, because, this is not executable by browsers!
Do you think people will post ugly UTF-7 encoded for injection in browsers?
Hackers have a huge arsenal of XSS vectors
Yes, i know. As webdeveloper i know the secrets of XSS and XSRF 🙂
if the HTML filter is eased up here, these forums will be at the mercy of 3rd parties that seek to do harm here
As a result, nobody can post correct examples for code here. One has to link to gists or pastebins from outside.
Asking for problems with browser bugs will hadicap people, if they cant post the relevant code.
OK, my fault, a support forum should not be a place for professional questions.
Thanks a lot.
