A Markdown preview should not execute HTML

Many “live Markdown” widgets call an HTML sanitizer — or skip sanitizing — and then set innerHTML. That is convenient until the document contains a script, a javascript: link, or an image that points at something you did not mean to load.

What a preview actually needs

Markdown is a writing format. The job of a previewer is to show headings, lists, emphasis, and links well enough to judge the draft. It does not need to be a browser inside a browser.

• Parse a documented subset (headings, lists, fences, links)
• Render React (or other) elements — not a string of HTML
• Allow http, https, and mailto links; drop javascript: and data:
• Treat raw HTML tags as text

Alphzen’s Markdown Previewer follows that list. It is not CommonMark-complete. Tables and raw HTML are out of scope on purpose.

If you already have HTML

Format it with the HTML Formatter, which does not use innerHTML either. Do not paste untrusted markup into a page that will execute it.