Markdown AST Parsing, CommonMark Rules & Client-Side XSS Sanitization

01. From Raw String to AST: The Modern Parsing Pipeline

Modern Markdown engines such as markdown-it, marked, micromark and remark follow the CommonMark specification, which defines parsing as a deterministic, multi-stage process instead of a series of find-and-replace passes:

1. Block structure: the engine reads the document line by line and decides which block each line belongs to: headings, lists, blockquotes, fenced code, tables (a GFM extension) and paragraphs. Containers can nest, so a list item may hold a blockquote that holds a code block.
2. Inline parsing: inside each paragraph or heading the engine tokenizes emphasis, code spans, links, images and autolinks. Emphasis is resolved with a delimiter-run algorithm that matches openers and closers, which is why **bold *italic** text* has one well-defined result instead of depending on regex luck.
3. AST generation: the result is a tree of typed nodes. A renderer walks this tree and emits HTML, PDF or plain text.

BlockquoteNode {
  ParagraphNode {
    StrongNode { text: "Important Note" },
    TextNode   { text: ": Check " },
    LinkNode   { href: "https://toolsgrid.online/", text: "documentation" }
  }
}

The tree is the important part. Because every piece of content is a typed node, a program can inspect, rewrite or reject nodes (for example, drop every LinkNode whose href is not http or https) before any HTML string exists. Regex pipelines never get that chance, since they go straight from text to text.

02. The Dangerous XSS Attack Vectors in Markdown

CommonMark deliberately passes raw HTML blocks and inline HTML through to the output. Parsers differ in their defaults: markdown-it ships with html: false, while marked renders raw HTML as written and its own documentation warns that it does not sanitize output. Attackers exploit exactly that gap:

Notice that none of these payloads need a Markdown bug. They are valid Markdown that the specification asks the parser to preserve. The security boundary therefore cannot live inside the Markdown parser alone.

03. Why Regex Filters Fail and Allowlist Sanitizers Work

The instinctive fix is a regex that deletes <script>. It fails because browsers are forgiving HTML parsers: <scr<script>ipt>, mixed-case tags, unquoted attributes, HTML entities inside javascript: URLs and malformed nesting all slip through a denylist. Sanitization has to run on a real parsed DOM, with an allowlist of tags and attributes that are known to be safe.

DOMPurify is the widely used implementation of this idea. It parses the HTML into an inert document, walks every node, keeps only allowlisted elements and attributes, removes event-handler attributes, and rejects dangerous URL schemes. Two rules matter in practice:

• Sanitize last. Run the sanitizer on the final HTML string that will be inserted into the page. If you modify the HTML after sanitizing it, you can re-introduce the problem.
• Sanitize where it is rendered. Pre-sanitizing on the server does not help a client that later concatenates strings, and a client-side check does not protect other consumers of the same HTML.

Defense in depth adds a Content-Security-Policy that forbids inline scripts, so that a sanitizer bug or a missed code path is not an automatic compromise.

04. How ToolsGrid Handles It

The Markdown to HTML Converter parses your text with marked in your own browser. Nothing is uploaded: your design documents, roadmaps and unreleased posts stay in local JavaScript memory.

The Visual Preview pane is passed through DOMPurify before it is mounted, so a pasted <img onerror=...> or javascript: link will not execute in your session. The Raw HTML pane and the Copy HTML button deliberately return the converter's exact output, because stripping tags from the code you copy would silently change your document.

05. A Practical Checklist

• Treat every Markdown source you do not author yourself as untrusted input, including comments, tickets and imported documents.
• Prefer parsers that disable raw HTML by default, or sanitize with an allowlist when you need to keep it.
• Allow only http, https and mailto link schemes, and add rel="noopener noreferrer" to external links.
• Sanitize the final HTML string, then insert it. Do not edit it afterwards.
• Add a Content-Security-Policy that blocks inline scripts as a second layer.