img attribute is getting removed

[snap9]

I'm using imgsrc to support high-resolution display images: https://webkit.org/demos/srcset/

Since Markdown has no built-in support for this, I'm writing out the HTML manually:

<img src="image.jpg" srcset="image-1x.jpg 1x, image-2x.jpg 2x, image-3x.jpg 3x">

But your Markdown library strips this down to

<img src="image.jpg">

It just gets rid of the srcset. Why, and how can I solve this?

[snoyberg]

Looks like the Cross Site Scripting (XSS) protection is kicking in. You can configure that via msXssProtect:

https://www.stackage.org/haddock/lts-7.18/markdown-0.1.16/Text-Markdown.html#v:msXssProtect

[snap9]

@snoyberg This worked. But do you think XSS should disable srcset? That's hardly a security risk. I thought XSS was only supposed to ban dangerous things like <script>.

[snoyberg]

I'm not sure if there are XSS implications to the srcset attribute. If you'd like it added to the whitelist, the relevant package for discussion would be:

https://github.com/yesodweb/haskell-xss-sanitize