Skip to content
Markvia

Security

The HTML renderer:

  • Escapes text content.
  • Treats raw HTML in Markdown as escaped text by default.
  • Preserves raw HTML only when compatibility mode is enabled, while escaping GFM-disallowed tag starters.
  • Allows only safe generated HTML tag and attribute names.
  • Ignores event attributes such as onclick.
  • Rejects unsafe URLs such as javascript: and data:.
  • Keeps the text of an unsafe link and marks it with data-markvia-unsafe-url="true".

Compatibility mode is available only for the HTML renderer:

import { createHTMLRenderer } from '@markvia/html'


const renderer = createHTMLRenderer({ allowRawHtml: true })
const html = runtime.render(source, renderer)

React and Vue do not expose a raw HTML opt-in and always output raw HTML as safe text. Even in HTML compatibility mode, GFM-disallowed iframe, script, style, textarea, title, and xmp tag starters are not passed through.

Safe HTML output

run

<script>alert(1)</script>
<p data-markvia-node-id="mv-paragraph-1cw6uly"><a data-markvia-node-id="mv-link-1cd8feu" data-markvia-unsafe-url="true">run</a></p>&lt;script&gt;alert(1)&lt;/script&gt;

Custom renderers

Section titled “Custom renderers”

If an application needs a different security policy, process Markvia output before passing it to the DOM or a template system, while keeping the URL validation boundary intact. Never pass unvalidated user input directly to Astro’s set:html.