A little worried(; · ∀ ·)

[HiroyukiNIshimura]

Although I am allowed to use because it is very favorite.

But ...

<script> alert ('xss') </ script>
... From being able to run the script such as it's the OK?

[HiroyukiNIshimura]

var preview = this.element.find('.rendered-markdown');

if (setting.xssok) {
    this.markdown = this.editor.getValue();
}
else {
    var stack = $('<div></div>').text(this.editor.getValue());
    this.markdown = $(stack).html();
}
this.html = this.converter.makeHtml(this.markdown);

[HiroyukiNIshimura]

Decent little more ideas :-)

$.widget( "b4m.ghostDown", {
    editor: null,
    markdown: null,
    html: null,
    converter: null,
    options: {
        tagRejections : null
    },

var preview = this.element.find('.rendered-markdown');
var dummy = $('<div></div>');

this.markdown = this.editor.getValue();
dummy.html(this.converter.makeHtml(this.markdown));
if (this.options.tagRejections) {
    dummy.find(this.options.tagRejections).remove();
}
this.html = dummy.html();
preview.html(this.html);

$('.editor').ghostDown({ tagRejections: 'script foo bar' });

[lenisko]

so... it's not committed yet?