On Jun 30, 5:20 am, Johan Sørensen <jo...@johansorensen.com> wrote:

I do know that most implementations have a HTML sanitizer built in to
avoid these kinds of problems. In fact, it appears that RDiscount does
- which you should be using instead of sanitizing it yourself. I
finally looked at the code to see what Gitorious was doing.

Now, I'm not all that familiar with ruby and haven't tested this, but
I believe you want to make this change:

--- app/helpers/pages_helper.rb 2009-06-23 08:54:31.000000000 -0400
+++ app/helpers/pages_helper.rb 2009-07-01 14:04:08.000000000 -0400
@@ -22,7 +22,7 @@

   def wikize(content)
     content = wiki_link(content)
-    rd = RDiscount.new(sanitize(content), :smart, :generate_toc)
+    rd = RDiscount.new(content, :smart, :filter_html, :generate_toc)
     content = content_tag(:div, rd.to_html, :class => "page-content")
     toc_content = rd.toc_content
     if !toc_content.blank?

Notice that I removed the call to `sanitize` (which is not markdown
aware and causing the problem) and added the `:filter_html` attribute.
The builtin html filter should accomplish the same thing as sanitize,
but in a way that won't break the markdown syntax.