We are currently implementing the following to evade XSS:
- iframe sandbox
- All important cookies are HttpOnly
- Using a renderer that does now render scripts, like markdown-it or react-markdown.
That being said, it still feels like here is a major gap in the ecosystem. There is no editor + renderer that works with something like reStructedText or BBCode, or some other format with no support for HTML tags or advanced functionality. Most editors and renderers work with Markdown, which is problematic. We'd love something super simple that will allow basic features with a minimal amount of exposed surface.
Does anyone have any recommendations on how to tackle this challenge?