I suggest changing the default modus operandi of cmark from unsafe to safe. I fear otherwise people will run cmake with the defaults to produce HTML which they deliver to their user, allowing an attacker to inject dangerous stuff into that HTML. Given the popularity of CommonMark, I do wonder if we don't have already a certain amount of vulnerable sites because of cmark's default behavior.
Or am I missing something? What is the reasoning behind performing unsafe operations per default, versus having to explicitly enable them?
I suggest changing the default modus operandi of cmark from unsafe to safe. I fear otherwise people will run cmake with the defaults to produce HTML which they deliver to their user, allowing an attacker to inject dangerous stuff into that HTML. Given the popularity of CommonMark, I do wonder if we don't have already a certain amount of vulnerable sites because of cmark's default behavior.
Or am I missing something? What is the reasoning behind performing unsafe operations per default, versus having to explicitly enable them?