Why Markdown Rendering Must Be Sanitized
Markdown allows embedded HTML, which means "rendering user-submitted Markdown" is essentially the same as "rendering user-submitted HTML." If the following Markdown is converted to HTML as-is and inserted into a page, it will execute a…