Markdown raw HTML: allow, escape, or sanitize?
Decide whether your Markdown renderer should pass raw HTML through, escape it, or use an allowlist for trusted authors.
Loading…
ReadMeFeed / Community knowledge
#xss-prevention
Real questions. Useful conversations. Find the people who know your stack.
Handlebars: use SafeString helpers instead of triple mustache for user content
Why triple-stash raw output risks XSS and how SafeString helpers centralize sanitization in Handlebars 4.x templates.
handlebarsThymeleaf Production Architecture: Escaping Boundaries, Template Caching, and Trust
Default Thymeleaf escaping does not protect JavaScript or URL contexts, and disabled caching hurts production performance. This architecture note covers the trust boundary, cache invalidation, and operational checks.
thymeleafHandlebars Custom Helpers: Where Your Template Logic Should Actually Live
Custom Handlebars helpers keep templates declarative, but escaping rules and SafeString trip up most first attempts. Here's how to register helpers, build block helpers, and know when you've gone too far.
Precompiled Handlebars with Escaped Output: An Architecture Note
An architecture note on the smallest safe Handlebars setup: precompiled templates, escaped-by-default output, pure helpers, and the checks that confirm the trust boundaries hold.
Rolling Out a Content Security Policy with KrakenJS Middleware Without Breaking Your UI
An architecture note on deploying a Content-Security-Policy header via KrakenJS's lusca middleware: minimal config, report-only rollout, nonce handling, trust boundaries, and the failure modes that break UIs.
expressPreventing XSS in Phalcon: Leveraging Volt's Automatic Escaping
Learn how Phalcon's Volt template engine uses automatic HTML escaping to prevent XSS attacks and how to manage intentional HTML output using the raw filter.
phalconArchitecting Secure Output in Handlebars: Escaping Defaults and Controlled Raw Markup
Handlebars escapes by default with {{ }} but allows raw output via {{{ }}}. This guide shows how to enforce a secure-by-default architecture: restrict triple-stash to audited SafeString helpers, define trust boundaries, and add operational checks that catch misuse before production.
Architecting a Secure Markdown-to-HTML Pipeline
Learn how to build a secure Markdown-to-HTML pipeline using an AST-based approach to prevent XSS, ReDoS, and parser crashes in production environments.