v1 and v2 of this library have always prioritized parsing correctness, especially for the default configuration values. These options are completely reasonable for trusted inputs, but can lead to vulnerabilities (especially denial-of-service) when handling untrusted inputs from potentially malicious users. Our README, documentation, etc. all try to make these risks and mitigations well-known: https://commonmark.thephpleague.com/2.x/security/
For v3, I think we should change to safe by default, where reasonable default limits and security settings come out-of-the-box unless explicitly configured otherwise.
Proposed Implementation
In 2.x, we should use @trigger_error() to notify whenever an insecure default config is used. This would hopefully encourage users to start providing the explicit values they want instead of accepting library defaults.
In 3.x, we would either:
- Change all default values for security-related options to reasonable defaults; or,
- Remove the default values so that users must provide their own explicit values
- We could also provide defaults as presets with names like
safe or unsafe
v1 and v2 of this library have always prioritized parsing correctness, especially for the default configuration values. These options are completely reasonable for trusted inputs, but can lead to vulnerabilities (especially denial-of-service) when handling untrusted inputs from potentially malicious users. Our README, documentation, etc. all try to make these risks and mitigations well-known: https://commonmark.thephpleague.com/2.x/security/
For v3, I think we should change to safe by default, where reasonable default limits and security settings come out-of-the-box unless explicitly configured otherwise.
Proposed Implementation
In 2.x, we should use
@trigger_error()to notify whenever an insecure default config is used. This would hopefully encourage users to start providing the explicit values they want instead of accepting library defaults.In 3.x, we would either:
safeorunsafe