js-xss VS showdown

Encode output data before user-controllable data is written to a page to prevent it from being interpreted as HTML or JavaScript. You can use tools like xss for this purpose.

xss-shield is a powerful middleware package that helps you protect your express.js app from Cross-Site Scripting (XSS) attacks. It's built on top of the popular xss (https://www.npmjs.com/package/xss) package and includes additional features like strict typing

I personally always tend to use this one. It's lightweight, configurable and has Typescript support built in

Searching for XSS specifically actually comes up with a few - https://www.npmjs.com/package/xss looks solid. I was being to literal in my search! Should have tried bing.

There are a few libraries you can use to protect from xss. For instance the xss library on npm.

Turns out showdown requires strict tabling, seen in https://github.com/showdownjs/showdown/issues/666

so it is slightly gfm incompatible

So you're going to need a Markdown parser that produces HTML. But there's a question of where is the data coming from and where you you want to process it? If it's going to be all on the frontend like a text editor, use a JS library for it (a quick google search produces ShowdownJS)

Previously, I was required to implement the markdown support manually which meant that the use of public libraries was prohibited. My tool could only support limited styling elements such as header1, header2, links, bold and italics, but now I can finally let my tool have a full markdown support by using Showdown.

The first two ages are very heavy on content so I decided to use markdown and tailwind’s typography plugin for styling. I also used showdown to fetch the markdown and turn it into HTML. The code for the above can be found on the site’s GitHub repository.

I'm using https://github.com/showdownjs/showdown for the core rendering-markdown functionality, with a bunch of additional listeners etc on top of it to fit it into the notion-style UX! Hope that helps :)

It looks like it uses showdown as the engine.

As you can see the content is returned as markdown - it's much more efficient to send the data this way, but in our frontend app we'll need to convert it to HTML. We'll probably use something like Showdown.

You should visit to official docs for advanced level tools of library. I'll show you how you can convert the md into html with GitHub flavour of markdown.