cnc-markdown-pagedown
A minimal markdown renderer built on Pagedown — one small script, no highlighting and no
sanitiser. It is the lightweight alternative to cnc-markdown, and the missing
sanitiser is the whole difference.
Quick start
Bind markdown to value. One script is fetched from a CDN at mount, so like its
siblings the element is empty server-side until that resolves.
<cnc-markdown-pagedown value="# Release notes
Some **bold** text."></cnc-markdown-pagedown>No sanitiser
Pagedown's output goes into the DOM unfiltered. Unlike cnc-markdown, which
sanitises by default, this widget has no allow-list, no URL-scheme check and no
safe
switch to turn on. Markdown that reaches it from a user — a comment, a profile, anything
submitted — can therefore inject script.
Use it ONLY for markdown you control and ship. For anything else, use
cnc-markdown, whose sanitiser is on by default. Filed as
#653, since two widgets this interchangeable should not differ silently on whether they
are safe.
Usage guidance
Default to cnc-markdown. It sanitises, highlights code and covers the same
markdown; this widget exists for the case where those extra modules are not worth fetching and
the source is entirely yours.
Never point it at user input. There is no switch that makes it safe, so the decision is made when you pick the widget rather than when you configure it.
It suits a live preview, since value is watched rather than polled — but the
text being previewed is usually about to be SAVED and shown to someone else, and at that point
it is user input and belongs in the sanitising widget.