# safe-markdown

Source: https://apigenie.pl/docs/linter/asyncapi/rules/safe-markdown

This rule ensures that Markdown strings (descriptions) do not contain unsafe
constructs like script tags or `eval()` calls.

## Rule Details

Unsafe constructs embedded in Markdown strings can pose security risks when
the documentation is rendered, for example by a documentation portal.

The `safe-markdown` rule checks the `description` field of every object that
supports CommonMark descriptions: the info object, servers, server variables,
channels, parameters, operations, operation traits, operation reply addresses,
messages, message traits, correlation IDs, tags, external documentation,
schemas and security schemes. It reports:

- `Markdown contains <script> tag` when a description contains a `script`
  element,
- `Markdown contains eval() function` when a description contains an
  `eval()` call.

## Configuration

None.

## Examples

**Good**.

```yaml
asyncapi: 3.0.0
info:
  title: Pet Events
  version: 1.0.0
  description: Events published when pets are adopted or returned.
```

**Bad**.

```yaml
asyncapi: 3.0.0
info:
  title: Pet Events
  version: 1.0.0
  description: "Events published when pets are adopted. <script>alert('Unsafe')</script>"
```

## Automatic fixes

When invoked with `--fix`, this rule escapes the delimiters of recognized
script elements and `eval()` calls. It preserves the surrounding Markdown and
does not alter code spans or fenced code blocks.

## When Not to Use It

We recommend to always enable this rule.

## Compatibility

This rule is compatible with AsyncAPI 3.x documents. AsyncAPI 2.x documents
are rejected by the reader and are not linted.