diff --git a/_docs/1-Installation-and-Setup.md b/_docs/1-Installation-and-Setup.md index c5bb1db..e38cd22 100644 --- a/_docs/1-Installation-and-Setup.md +++ b/_docs/1-Installation-and-Setup.md @@ -22,7 +22,6 @@ The Laravel Markdown package has a few system requirements: [laravel_markdown_1_1_x]: https://img.shields.io/badge/version-1.1.*-blue.svg?style=flat-square "Laravel Markdown v1.1.*" [laravel_markdown_1_2_x]: https://img.shields.io/badge/version-1.2.*-blue.svg?style=flat-square "Laravel Markdown v1.2.*" - ## Composer You can install this package via [Composer](http://getcomposer.org/) by running this command: `composer require arcanedev/laravel-markdown`. diff --git a/config/markdown.php b/config/markdown.php index a76bd9f..4216e29 100644 --- a/config/markdown.php +++ b/config/markdown.php @@ -1,6 +1,7 @@ true, + + /* ----------------------------------------------------------------- + | Escape Markups + | ----------------------------------------------------------------- + | Allowing or not to escape the HTML markups. + */ + 'markups' => true, + ]; diff --git a/src/MarkdownParser.php b/src/MarkdownParser.php index 3d29a21..d142de9 100644 --- a/src/MarkdownParser.php +++ b/src/MarkdownParser.php @@ -58,6 +58,7 @@ public function __construct(Parsedown $parser) public function parse($content) { $this->parser->setUrlsLinked(config('markdown.urls', true)); + $this->parser->setMarkupEscaped(config('markdown.markups', true)); if (config('markdown.xss', true)) { $content = preg_replace('/(\[.*\])\(javascript:.*\)/', '$1(#)', $content); diff --git a/tests/MarkdownParserTest.php b/tests/MarkdownParserTest.php index 9ded0d0..4344a0e 100644 --- a/tests/MarkdownParserTest.php +++ b/tests/MarkdownParserTest.php @@ -102,6 +102,22 @@ public function it_can_clean_xss() ); } + /** @test */ + public function it_can_escape_markups() + { + $this->assertEquals( + '
<b>This is a script</b><script>alert(\'hello\');</script>
', + $this->parser->parse("This is a script") + ); + + $this->app['config']->set('markdown.markups', false); + + $this->assertEquals( + 'This is a script
', + $this->parser->parse("This is a script") + ); + } + /** @test */ public function it_can_autolink_the_urls() {