Allow cmark `--unsafe` flag?

barneyh commented

2026-01-28 17:27:21 +01:00

Hi,
New user of BSSG here and really enjoying thus far. I'm trying to add some custom attributes to my images so that I can utilise some fun JS libraries (https://github.com/sneas/img-comparison-slider) on my site. The requires HTML is this:

<img-comparison-slider>
  <img slot="first" src="before.jpg" />
  <img slot="second" src="after.jpg" />
</img-comparison-slider>

But I can't work out how to generate the required HTML via the .md -> cmark build process, and I keep seeing  in my output files. I see that passing the --unsafe flag to the cmark command allows the embedded html to pass through. Would it be possible to enable this as a local configuration option perhaps? Or does it present security issues that I'm not aware of?

Cheers,

Hi, New user of BSSG here and really enjoying thus far. I'm trying to add some custom attributes to my images so that I can utilise some fun JS libraries (https://github.com/sneas/img-comparison-slider) on my site. The requires HTML is this: ``` <img-comparison-slider> <img slot="first" src="before.jpg" /> <img slot="second" src="after.jpg" /> </img-comparison-slider> ``` But I can't work out how to generate the required HTML via the .md -> cmark build process, and I keep seeing `` in my output files. I see that passing the `--unsafe` flag to the cmark command allows the embedded html to pass through. Would it be possible to enable this as a local configuration option perhaps? Or does it present security issues that I'm not aware of? Cheers,

mrecondo commented

2026-01-28 19:07:51 +01:00

I solved this by creating an alias to cmark with the unsafe flag always on.

barneyh commented

2026-01-28 20:21:17 +01:00

Author

Ah, nice workaround! Thanks. Guess I might leave the issue open for a bit in case passing flags to the parsing tools is something worth exploring?

barneyh commented

2026-01-28 21:01:02 +01:00

Author

@mrecondo wrote in #46 (comment):

I solved this by creating an alias to cmark with the unsafe flag always on.

Actually, I can't figure out how to do this on macosx. ./bssg.sh calls a non-interactive shell via /usr/bin/env bash and none my aliases seem to take effect. Any advice?

@mrecondo wrote in https://brew.bsd.cafe/stefano/BSSG/issues/46#issuecomment-323: > I solved this by creating an alias to cmark with the unsafe flag always on. Actually, I can't figure out how to do this on macosx. `./bssg.sh` calls a non-interactive shell via `/usr/bin/env bash` and none my aliases seem to take effect. Any advice?

mrecondo commented

2026-01-28 21:47:33 +01:00

I haven't used macos for a long time. No idea how to solve this. Sorry

barneyh commented

2026-01-29 15:19:04 +01:00

Author

Resorted to changing ln 320 from /scripts/build/content.sh from:

if ! html_content=$(echo "$content" | cmark); then

to

if ! html_content=$(echo "$content" | cmark --unsafe); then

hacky and unsustainable but did the job for now.

Resorted to changing ln 320 from `/scripts/build/content.sh` from: ` if ! html_content=$(echo "$content" | cmark); then` to ` if ! html_content=$(echo "$content" | cmark --unsafe); then` hacky and unsustainable but did the job for now.

👍 1

Rows
Columns

Allow cmark --unsafe flag? #46

Allow cmark `--unsafe` flag? #46