Will remark-rehype filter html strings?

[hqqxxf]

show the code

const file = unified()
  .use(remarkParse)
  .use(remarkRehype)
  .use(rehypeStringify)
  .processSync('<div>123</div>')
const html = String(file);
console.log(html);

Why is the output result empty?

so add rehype-sanitize is useless

[wooorm]

Take time to formulate your question: when you do, you’ll figure out the answer yourself.

Take some time to read the docs. You need to configure the plugins you use (hint: allowDangerousHtml, use rehype-raw)

[hqqxxf]

I tryed this option，html is escaped。but I need use rehypeSanitize to show safe html

const text = `
<div onmouseover="alert('alpha')">
  <a href="jAva script:alert('bravo')">delta</a>
  <img src="x" onerror="alert('charlie')">
  <iframe src="javascript:alert('delta')"></iframe>
  <math>
    <mi xlink:href="data:x,<script>alert('echo')</script>"></mi>
  </math>
</div>
<script>
require('child_process').spawn('echo', ['hack!']);
</script>
`
const file = unified()
  .use(remarkParse)
  .use(remarkRehype, {allowDangerousHtml: true})
  .use(rehypeSanitize)
  .use(rehypeStringify, {allowDangerousHtml: true})
  .processSync(text)
const html = String(file);
console.log(html);

Why is the output different from the demo output of rehype-sanitize?

[wooorm]

How could I see what you mean, if you don’t show that output?

The quick answer: because your code is different.

You use remark to parse. Because you deal with markdown as input. That example uses rehype to parse. It deals with HTML as input.

[ChristianMurphy]

Welcome @hqqxxf! 👋
Check out the guide on the unified site explaining the ways to use HTML in Markdown https://unifiedjs.com/learn/recipe/remark-html/