3 homepage: https://github.com/kivikakk/comrak
5 Comrak is a Rust port of github's cmark-gfm.
12 Use the `@beta` tag for pre-releases.
16 > Comrak supports the five extensions to CommonMark defined in the GitHub
17 > Flavored Markdown Spec: Tables, Task list items, Strikethrough, Autolinks, &
21 comrak --gfm index.md > index.html
24 Here you'll learn how to:
26 - Convert Markdown to HTML
27 - Set Reasonable Defaults
28 - Safely Render _Untrusted_ HTML
29 - Render _Trusted_ HTML with Scripts
30 - Temporarily Ignore Defaults
32 ## How to Convert Markdown to HTML
35 comrak --gfm --header-ids '' README.md > README.html
38 ## How to set Reasonable Defaults
40 You can update `~/.config/comrak/config` to change Comrak from it's very strict
41 defaults to always include your favorite options.
43 Here's what I suggest:
46 echo "--gfm --header-ids ''" > ~/.config/comrak/config
49 See `comrak --help` for other options.
51 ## How to Render _Untrusted_ HTML
53 Comrak does NOT have an option to allow arbitrary HTML while protecting against
54 unsafe links, such as `<a href="javascript:...">`.
56 Therefore, you **MUST enable CSP** for comrak-rendered site to disallow unsafe
57 inline scripts. This can be done via a `<meta>` tag or HTTP headers.
62 <meta http-equiv="Content-Security-Policy" content="default-src *" />
65 Then, to sanitize `<script>` and `<iframe>` tags you must add `-e tagfilter`
66 (which the `--gfm` option also enables).
69 comrak --unsafe --gfm --header-ids '' README.md
72 ## How to Render HTML & Scripts
75 [may not work as expected](https://github.com/kivikakk/comrak/issues/160) with
76 `--gfm`, as it is still somewhat neutered by `-e tagfilter`.
78 If you want Github-Flavored Markdown with trusted scripts, you'll need to enable
79 its extensions by hand:
83 # WARNING: allows <script>, <iframe>
84 # and <a href=javascript:alert('')>
87 # same as --gfm, but without -e tagfilter,
88 # meaning ALL html tags are allowed
95 # linkable headers (w/ empty prefix)
98 # additional extensions
103 " > ~/.config/comrak/allow-scripts
107 comrak --config ~/.config/comrak/allow-scripts README.md
110 ## How to Ignore Defaults
112 You can disable all options with `--config-file none`.
117 comrak --config-file none -e table README.md