I'm trying to render user input using SvelteMarkdown (that uses marked).
The steps are:
- user input is sanitized using sanitizeHtml
- sanitized user input goes to
SvelteMarkdownto be rendered inhtml
The problem is that it does not render special characters as they should be displayed. It is because they are converted two times.
- input "Tom & Jerry"
sanitizeHtml("Tom & Jerry")>"Tom & Jerry"- this is the format that browser needs to render it correctlySvelteMarkdown("Tom & Jerry")>"Tom & Jerry"
Not sure how to make this work while preserving safety measures. When I don't use sanitizeHtml, many things can go bad, for example <img src='x' onerror='alert("XSS")'> opens alert window after the content is rendered.
What I want to do is to render some characters like "<", ">", "&" etc but still be "safe" as I work with user generated content.
Are there any solutions?