# A Onebox for a Discourse category does not render Markdown properly

**URL:** https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545
**Category:** Feature
**Created:** [2017年二月17日 13:20 UTC](https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545 "2017-02-17T13:20:11Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![dmitry\_fedyuk](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dmitry_fedyuk/32/293153_2.png) [@dmitry\_fedyuk](https://meta.discourse.org/u/dmitry_fedyuk)
#### Post date: [2017年二月17日 13:20 UTC](https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545/1 "2017-02-17T13:20:11Z")

</div>

An example:

> **[Stripe](https://mage2.pro/c/extensions/stripe/26)**
>
> The module integrates Magento 2 with the Stripe payment service. 
> The module is free and open source.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2017年二月17日 20:35 UTC](https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545/2 "2017-02-17T20:35:50Z")

</div>

That’s correct, otherwise there are a million markup exploits we are open to. I think that’s a default for the onebox..

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [2017年二月17日 20:41 UTC](https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545/3 "2017-02-17T20:41:11Z")

</div>

I agree with not parsing the HTML, but passing it though Sanitize.clean might make it look better. eg.

```plaintext
The extension integrates your Magento 2 store with the Stripe payment service.

```

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2017年二月17日 20:46 UTC](https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545/4 "2017-02-17T20:46:07Z")

</div>

Sure that’s a good idea @zogstrip – I think you touched this last, for the prior round of Hacker One fixes?

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [2017年五月17日 19:22 UTC](https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545/6 "2017-05-17T19:22:32Z")

</div>

I’ve addded HTML stripping to the description in the latest onebox. Should be deployed shortly:

[https://github.com/discourse/onebox/commit/252c35dc97a5932cd689ce4a9d5fea265a2313fd](https://github.com/discourse/onebox/commit/252c35dc97a5932cd689ce4a9d5fea265a2313fd)

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [2017年五月17日 19:22 UTC](https://meta.discourse.org/t/a-onebox-for-a-discourse-category-does-not-render-markdown-properly/57545/7 "2017-05-17T19:22:41Z")

</div>