# Markdown preview and result differ

**URL:** <https://meta.discourse.org/t/markdown-preview-and-result-differ/263878>\
**Category:** Bug\
**Tags:** composer\
**Created:** [May 4, 2023, 8:05pm UTC](https://meta.discourse.org/t/markdown-preview-and-result-differ/263878 "2023-05-04T20:05:18Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [May 12, 2023, 2:36am UTC](https://meta.discourse.org/t/markdown-preview-and-result-differ/263878/8 "2023-05-12T02:36:20Z")

</div>

I just tried the HTML5 version of loofah and we are hitting a security issue it seems:

[https://github.com/discourse/discourse/pull/21522](https://github.com/discourse/discourse/pull/21522)

```plaintext

  1) PrettyText provides safety for img bbcode
     Failure/Error: expect(cooked).to eq(html)
     
       expected: "<p><img src=\"http://aaa.com&lt;script&gt;alert(1);&lt;/script&gt;\" alt=\"\" role=\"presentation\"></p>"
            got: "<p><img src=\"http://aaa.com<script>alert(1);</script>\" alt=\"\" role=\"presentation\"></p>"
     
       (compared using ==)
     # ./spec/lib/pretty_text_spec.rb:2150:in `block (2 levels) in <main>'
     # ./spec/rails_helper.rb:358:in `block (2 levels) in <top (required)>'
     # /home/sam/.gem/ruby/3.2.1/gems/webmock-3.18.1/lib/webmock/rspec.rb:37:in `block (2 levels) in <top (required)>'

```

This one feels very risky to me… will raise…

---

_[View the full topic](https://meta.discourse.org/t/markdown-preview-and-result-differ/263878)._