Separate html encoding & sanitizing for CmsKit MarkdownRenderer

modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/CmsKit/Shared/Components/Commenting/CommentingViewComponent.cs

@@ -65,12 +65,12 @@ public class CommentingViewComponent : AbpViewComponent
         foreach (var comment in viewModel.Comments)
         {
             viewModel.RawCommentTexts.Add(comment.Id, comment.Text);
-            comment.Text = await MarkdownToHtmlRenderer.RenderAsync(comment.Text, true);
+            comment.Text = await MarkdownToHtmlRenderer.RenderAsync(comment.Text, allowHtmlTags: false, preventXSS: true);
 
             foreach (var reply in comment.Replies)
             {
                 viewModel.RawCommentTexts.Add(reply.Id, reply.Text);
-                reply.Text = await MarkdownToHtmlRenderer.RenderAsync(reply.Text, true);
+                reply.Text = await MarkdownToHtmlRenderer.RenderAsync(reply.Text, allowHtmlTags: false, preventXSS: true);
             }
         }
     }

modules/cms-kit/src/Volo.CmsKit.Public.Web/Pages/Public/CmsKit/Blogs/BlogPost.cshtml

@@ -72,7 +72,7 @@
                             {
                                 if (contentFragment.Type == ContentConsts.Markdown)
                                 {
-                                    @Html.Raw(await MarkdownRenderer.RenderAsync(contentFragment.GetProperty<string>("Content")))
+                                    @Html.Raw(await MarkdownRenderer.RenderAsync(contentFragment.GetProperty<string>("Content"), allowHtmlTags: true, preventXSS: true))
                                 }
                                 else if (contentFragment.Type == ContentConsts.Widget)
                                 {
@@ -92,13 +92,13 @@
                                 if (Model.TagsFeature?.IsEnabled == true)
                                 {
                                     @await Component.InvokeAsync(typeof(TagViewComponent), new
-                            {
-                            entityType = Volo.CmsKit.Blogs.BlogPostConsts.EntityType,
-                            entityId = Model.BlogPost.Id.ToString(),
-                            urlFormat = $"/blogs/{Model.BlogSlug}?tagId={{TagId}}"
-                            })
+                                    {
+                                        entityType = Volo.CmsKit.Blogs.BlogPostConsts.EntityType,
+                                        entityId = Model.BlogPost.Id.ToString(),
+                                        urlFormat = $"/blogs/{Model.BlogSlug}?tagId={{TagId}}"
+                                    })
+                                }
                             }
-                        }
                     </div>
                 </abp-row>
 

modules/cms-kit/src/Volo.CmsKit.Public.Web/Renderers/IMarkdownToHtmlRenderer.cs

@@ -4,5 +4,5 @@ namespace Volo.CmsKit.Public.Web.Renderers;
 
 public interface IMarkdownToHtmlRenderer
 {
-    Task<string> RenderAsync(string rawMarkdown, bool preventXSS = true);
+    Task<string> RenderAsync(string rawMarkdown, bool allowHtmlTags = true, bool preventXSS = true);
 }

modules/cms-kit/src/Volo.CmsKit.Public.Web/Renderers/MarkdownToHtmlRenderer.cs

@@ -20,9 +20,9 @@ public class MarkdownToHtmlRenderer : IMarkdownToHtmlRenderer, ITransientDepende
         _htmlSanitizer = new HtmlSanitizer();
     }
 
-    public async Task<string> RenderAsync(string rawMarkdown, bool preventXSS = false)
+    public async Task<string> RenderAsync(string rawMarkdown, bool allowHtmlTags = true, bool preventXSS = true)
     {
-        if (preventXSS)
+        if (!allowHtmlTags)
         {
             rawMarkdown = EncodeHtmlTags(rawMarkdown, true);
         }