BukkitDev Formatting Options and Security

A couple weeks ago many of you brought up an issue regarding the loss of formatting options on BukkitDev, our Minecraft plugins download service powered by CurseForge. After further investigation, it turns out several formats were disabled due to the security risk they posed to the site - a severe XSS vulnerability was discovered in the Markdown parser as well as a potential security risk in the Safe HTML parser.

As a security precaution the affected parsers were disabled from further usage and new projects were forced to use a more secure alternative. Unfortunately, due to a bug in the system, every project was accidentally set to the WikiCreole format and developers found themselves unable to switch their projects back to the formatting they previously used. This was a bug and completely unintended.

Having conducted an extensive investigation into the vulnerabilities we discovered and concluding that we have addressed them accordingly, I'm happy to announce that Safe HTML is back (along with the ability to use it within Markdown too).

The new and improved Safe HTML (and Markdown) supports the following tags:
a, abbr, b, big, blockquote, br, caption, code, dd,
del, dl, dt, em, h1, h2, h3, h4, h5, h6, hr, i,
img, li, ol, p, pre, s, small, strike, strong, sub,
sup, table, tbody, td, tfoot, th, thead, tr, ul

And attributes:
alt, colspan, href, rowspan, src, title

If you have any tags and attributes you'd like to see supported, please post a comment on the BukkitDev article here and we'll take your input into consideration.

 

That's nice! Any way you guys could include spoiler tags in WikiCreole?

 

We know you don't goof us to troll us, you are human!

 

As far as I know there isn't actually a spoiler built into WikiCreole. However, I would like to see this too so I'll do some digging and see if it's possible at all

 

My plugin that used Safe HTML is intact, aside from the missing <u> which I've reported.

 

I with they had the formatting options on BukkitDev that are on the forums.

Code:

[code]
[URL]
[IMG]

Instead of annoying {{'s.

tl;dr
Long live BBCode!

 

:O let's make the forums support wikicreole