WMD editor sanitizing

Question

I am trying to find ways to sanitize the input of the WMD editor.

Specifically, I am trying to make HTML tags only available in the <code>tags that WMD generates. Is that possible

My problem is that the following code is rendered as HTML which is vunerable to potential XSS attacks.

For example, <a onmouseover="alert(1)" href="#">read this!</a>

The above code renders normally both in preview mode and when saved to the database.

I notice that Stack Overflow doesn't seem to have this problem. The same code is just rendered as text.

I notice that the Stack Overflow team has shared their code in http://refactormycode.com/codes/333-sanitize-html. Do I really have to use C# in order to sanitize WMD to do this?

Answer 1

I ended up using HTML Purifier for this.