We want to implement a "safe mode" in a Markdown parser called Parsedown. We have a MarkupEscaped
option that disables HTML input, but this is not enough. In order to be safe, the parser needs to sanitise user generated attribute values.
These are the:
href
andtitle
attributes ofa
tags.src
andtitle
attributes ofimg
tags.
How should we process these values to make them safe for the attributes that they belong to?
[xss](http://"onmouseover="alert(1))
.