tessl/npm-marked
tessl install tessl/npm-marked@17.0.0A markdown parser built for speed
security.mddocs/guides/
Security Guide
Best practices for secure markdown parsing.
Critical: No HTML Sanitization
Marked does NOT sanitize HTML output. Always use a sanitization library.
import { marked } from "marked";
import DOMPurify from "dompurify";
// UNSAFE
const unsafeHtml = marked.parse(userInput);
// SAFE
const dirty = marked.parse(userInput);
const clean = DOMPurify.sanitize(dirty);Recommended Sanitization Libraries
- DOMPurify - Most comprehensive
- sanitize-html - Configurable
- js-xss - Lightweight
Additional Security Measures
- Validate and limit file sizes
- Implement rate limiting for user input
- Use Content Security Policy (CSP) headers
- Disable dangerous markdown features if not needed
XSS Prevention
import { marked } from "marked";
import DOMPurify from "dompurify";
function safeRender(markdown) {
const html = marked.parse(markdown);
return DOMPurify.sanitize(html, {
ALLOWED_TAGS: ['p', 'strong', 'em', 'a', 'ul', 'ol', 'li'],
ALLOWED_ATTR: ['href']
});
}