Markdown Raw HTML Filtering
Last updated: 2026-10-14
Raw HTML Filtering GFM extension
Passing raw HTML invites XSS: <script>, onclick attributes and javascript: URLs are all injection points. Safe renderers filter dangerous tags and attributes via sanitizing or allow-lists.
| Group | Edge Cases & Rules |
|---|---|
| Spec level | GFM extension |
| Spec version | CommonMark 0.31.2 + GFM |
📝 Syntax
(no fixed syntax — know the filtering strategies)▶ Live Example
Edit Markdown on the left, see the result on the right
💡 Key points
⚠️ Warning Anything rendering user input must sanitize; this site's editor ships DOMPurify.
ℹ️ Note GitHub's allow-list is strict: script, iframe and style are gone, event attributes stripped.
❓ FAQ
Q Sanitizing vs allow-list?
A Sanitizers (DOMPurify) strip dangerous nodes; allow-lists keep only listed tags.
Q Does <script> run inside a code block?
A No — code block content is escaped and displayed literally, safe by design.
Q What is this site's policy?
A markdown-it html:true passthrough plus DOMPurify sanitizing in the editor.
📚 See also
Inline HTMLCommonMark core