Make it configurable whether HTML is suppressed for Markdown
Until now inline HTML blocks as well as inline HTML tags in Markdown
were suppressed because allowing HTML for user-provided input is a
security risk, e.g. code for XSS attacks may be contained in the HTML.
However the basic idea of Markdown is to provide a simple syntax for
basic formatting and fall back to HTML if a more sophisticated
formatting is needed. With supressing HTML this fall back is not
possible.
Enable Gerrit administrators to allow HTML in Markdown in spite of the
security risk. This may make sense for closed Gerrit installations
with a trusted user base.
Change-Id: If2acbb21414a9fa8c00af2865597b2502da4ae3e
Signed-off-by: Edwin Kempin <edwin.kempin@sap.com>
3 files changed
