Merge pull request #19 from tanabe/feature/issue-18-fix-self-xss

Fix #18

public/index.html

@@ -14,6 +14,7 @@
     <script type="text/javascript" src="js/jquery-1.6.1.min.js"></script>
     <script type="text/javascript" src="js/jquery.autosize-min.js"></script>
     <script type="text/javascript" src="js/marked.min.js"></script>
+    <script type="text/javascript" src="js/purify.min.js"></script>
     <script type="text/javascript" src="js/main.js"></script>
 
     <title>Markdown Live Preview</title>

public/js/main.js

@@ -9,7 +9,8 @@ $(function() {
 
   let convert = () => {
     let html = marked($('#markdown').val());
-    $('#output').html(html);
+    let sanitized = DOMPurify.sanitize(html);
+    $('#output').html(sanitized);
   }
 
   $('#markdown').bind('keyup', function() {