Markdown不支持embed标签(比如youku视频)?求解!
<embed src="http://player.youku.com/player.php/sid/XNzMxNzUyMzY=/v.swf" allowFullScreen="true" quality="high" width="480" height="400" align="middle" allowScriptAccess="always" type="application/x-shockwave-flash"></embed>
allowedTags 添加:
embed //支持 flash 视频
table|thead|tbody|tr|td|th|caption //支持表格
allowedAttributes 添加:
embed:'src|quality|width|height|align|allowScriptAccess|allowFullScreen|mode|type'
table: 'class'
但是测试过,nodeclub本身也没支持embed哦
添加了以上allowed也没有,看源码就知道在Markdown
函数里调用Showdown.makeHtml(text);
时就已经把<embed>
标签置于<p>
标签下了!
@kamaliang 晚上回家测试
经测试加了embed标签是可以支持flash的
exports.markdown = function(text, forceProtocol){
var allowedTags =
'a|b|blockquote|code|del|dd|dl|dt|em|h1|h2|h3|i'+
'|img|li|ol|p|pre|sup|sub|strong|strike|ul|br|hr'+
'|embed|table|thead|tbody|tr|td|th|caption',
allowedAttributes = {
'img': 'src|width|height|alt',
'a': 'href',
'*': 'title',
'embed': 'src|quality|width|height|align|allowScriptAccess|allowFullScreen|mode|type',
'table': 'class'
}
return Markdown(text, true, allowedTags, allowedAttributes, forceProtocol);
}
经调试发现,是var content = sanitize(req.body.r_content).trim();content = sanitize(content).xss();
这里把<embed>
的标签给转义了,转为<
之类的,所以最终渲染的不是html标签,而是字符串,囧!