Urgent.News

One page, thousands of outlets. See who else covered it.

Editions

Tech

Your Markdown Parser Is Not Your XSS Boundary

A Markdown parser can produce exactly the right HTML and still leave your application exposed to XSS. Parsing answers what the input means. Sanitization decides which parts of that meaning are allowed to reach an HTML sink. I tested that boundary with Node.js 25.3.0, Marked 18.0.7, DOMPurify 3.4.12, and jsdom 30.0.1. The important comparison is not a screenshot. It is the HTML before and after…

We haven't written up this one. Dev.to has the full story — the link below goes straight to it.

Read the original at dev.to →

More in Tech

More from Wednesday 19 August →