JSFiddle - React, Tailwind, and code Playground

Fixed Markdown Sanitize Issue

by Nalin Sajwan

HTML

<script src="//cdn.jsdelivr.net/simplemde/latest/simplemde.min.js"></script>
<link rel="stylesheet" href="//cdn.jsdelivr.net/simplemde/latest/simplemde.min.css">
<script src="https://cdnjs.cloudflare.com/ajax/libs/marked/0.6.0/marked.min.js"></script>
<textarea id="markdown-editor">
**This is  xss trial description**

Script Link - 
[XSS](javascript:alert%28sessionStorage.clear%28%29%29)

Simple Link- 
[Google](https://google.com)
</textarea>

JavaScript

/*
    Override markdown rendering defaults for Simple MDE.

    This resolves XSS vulnerability which can be exploited
    when previewing malicious text in the editor.

    https://github.com/sparksuite/simplemde-markdown-editor/issues/721
    https://snyk.io/vuln/SNYK-JS-SIMPLEMDE-72570
*/

marked.setOptions({ sanitize: true });

new SimpleMDE({
		previewRender: function(plainText) {
				return marked(plainText);
		},
		element: document.getElementById("markdown-editor"),
});