Store, sanitize and parse Markdown

[snap]

@amnu3387

I think it makes more sense to sanitize it prior to saving to the DB - usually when saving you’re not as worried with performance as when serving something from the DB, plus when saving you can “background” the sanitization (depending on your back-front architecture and UX ofc), whereas when serving you can’t - sanitizing when serving also means it has to be sanitized whenever requested, while when saving it only has to be once.

We had the same thoughts. But the only reason I need to sanitize is because of rendering parsed markdown using raw/1, as Phoenix serves :safe strings by default (correct?). So my idea was the most safe place to sanitize is where I render raw html, and not assume the content has been sanitized beforehand.

@amnu3387

Phoenix html sanitizer uses html_sanitizer underneath, and html_sanitizer has a markdown option so probably you can use that directly (?), before saving, and then just parse it regularly when serving. I think I would probably sanitize & parse into html before saving, but that would needs some benchmarking to make sure it’s more performative (although again, it means those things would only happen once per saving, and not once per request - which may or may not matter depending on what this is being used for?)

Yea I’ve noticed html_sanitize_ex is used under the hood, and it’s possible to use the :markdown_html mode directly. But I have the feeling it’s meant to be used after markdown is parsed, only stripping the unsafe html and leaving the rest intact.

Either way, sanitizing markdown always seem to come with a downside (see my initial problem). I lose support for blockquotes in markdown (using strict :strip_tags mode). Or I allow users to use basic HTML as markup language (using :markdown_html or :basic_html mode).
Maybe I’m missing something here, but somehow both options are unsatisfying. Also please correct me if my logic fails here.

Thanks for your input guys