Purify parsed markdown output

This may impact page load times, but it's a necessary evil until parsedown's XSS improvements are added.

See erusev/parsedown#495.

Author: BytewaveMLP

app/Twig/Markdown/SafeParsedownEngine.php

@@ -16,28 +16,34 @@ class SafeParsedownEngine implements MarkdownEngineInterface {
 	 */
 	protected $engine;
 
+	protected $htmlPurifier;
+
 	/**
 	 * @param string|null $instanceName
 	 */
 	public function __construct($instanceName = null)
 	{
 		$this->engine = \Parsedown::instance($instanceName);
 		$this->engine->setMarkupEscaped(true);
+
+		$this->htmlPurifier = new \HTMLPurifier(\HTMLPurifier_Config::createDefault());
 	}
 
 	/**
 	 * {@inheritdoc}
 	 */
 	public function transform($content)
 	{
-		return $this->engine->parse($content);
+		$parsed = $this->engine->parse($content);
+
+		return $this->htmlPurifier->purify($parsed);
 	}
 
 	/**
 	 * {@inheritdoc}
 	 */
 	public function getName()
 	{
-		return 'erusev/parsedown (safe)';
+		return 'erusev/parsedown (safe/purified)';
 	}
 }

composer.json

@@ -16,7 +16,8 @@
         "twig/twig": "~2.0",
         "mailgun/mailgun-php": "^2.3",
         "php-http/guzzle6-adapter": "^1.1",
-        "crossjoin/pre-mailer": "^1.0"
+        "crossjoin/pre-mailer": "^1.0",
+        "ezyang/htmlpurifier": "dev-master"
     },
 	"autoload": {
 		"psr-4": {