fix: exclude non-class attributes from markdown rendering in editor preview (#1251)

5 years ago · 115472a3fc
parent 46630e1638
commit 115472a3fc
1 changed files with 3 additions and 1 deletions
--- a/client/components/editor/editor-markdown.vue
+++ b/client/components/editor/editor-markdown.vue
@ -233,7 +233,9 @@ const md = new MarkdownIt({
    return `<pre class="line-numbers"><code class="language-${lang}">${str}</code></pre>`
  }
 })
-  .use(mdAttrs)
+  .use(mdAttrs, {
+    allowedAttributes: ['id', 'class', 'target']
+  })
  .use(mdEmoji)
  .use(mdTaskLists, {label: true, labelAfter: true})
  .use(mdExpandTabs)