Skip to content

Allow rendering description as Markdown. #6

@louh

Description

@louh

The info button implementation (#1) only allows for plain text -- this is because raw HTML (as requested originally) poses a security risk. It would be possible for someone to write a scene with malicious code saved in the description, and then send it to someone where the injected code could hijack that person's credentials and take over their Mapzen account.

It is safer to render the content via Markdown so that the person who provides the description can still add links, bold or italicized text, paragraphs, and more. As a result, the description render should make use of a Markdown rendering library to run description text through. (CommonMark spec is preferred.)

Along with this, there should be instructions in Tangram Play for Markdown syntax.

cc @burritojustice

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions