Do you set `unsafe = true` in `[markup.goldmark.renderer]`?

[iaeiou]

On the same topic:

Hugo + CMS and 'unsafe = true'

Hi there, we are reviewing Hugo Themes, in particular Netlify-CMS compatible themes. We would like with this CMS to open the publication: to users with no technical skills ( i.e pasting random content in the CMS) to users we don’t trust ( i.e potentially trying to exploit the platform) No moderation will take place, the content goes straight from the CMS to some live & public HTML. Question #1: Do you have general advice about this usecase? (let’s first consider that unsafe is set to fals…

Follow-up:

Hugo with a CMS for Open-publishing: security with Markdown Attributes

Hi there, this is a follow-up on a previous post about using Hugo with a CMS for open-publishing. To summarize, the original question was: Is it safe to use Hugo and a CMS for open-publishing with the setting unsafe = true? The answer was crystal clear: No Allright, so let’s use unsafe = false But another important issue was raised by @pamubay: Even if you set ‘unsafe = false’, the CMS user can trigger some Javascript: ​```html {onclick="alert('xss')" onmouseenter="alert('xss-onmous…