Merge pull request #17 from showdownjs/hotfix/issue_14

Hotfix/issue 14

Author: tivie

.travis.yml

@@ -16,4 +16,4 @@ sudo: false
 cache:
   directories:
     - node_modules
-
+    - bower_components

dist/ng-showdown.js

@@ -10,9 +10,10 @@
     (function (module, showdown) {
       'use strict';
 
-      module.provider('$showdown', ngShowdown)
-        .directive('sdModelToHtml', ['$showdown', '$sce', markdownToHtmlDirective]) //<-- DEPRECATED: will be removed in the next major version release
-        .directive('markdownToHtml', ['$showdown', '$sce', markdownToHtmlDirective])
+      module
+        .provider('$showdown', ngShowdown)
+        .directive('sdModelToHtml', ['$showdown', '$sanitize', '$sce', sdModelToHtmlDirective]) //<-- DEPRECATED: will be removed in the next major version release
+        .directive('markdownToHtml', ['$showdown', '$sanitize', '$sce', markdownToHtmlDirective])
         .filter('sdStripHtml', ['$showdown', stripHtmlFilter]) //<-- DEPRECATED: will be removed in the next major version release
         .filter('stripHtml', ['$showdown', stripHtmlFilter]);
 
@@ -28,7 +29,8 @@
 
         // Configuration parameters for Showdown
         var config = {
-          extensions: []
+          extensions: [],
+          sanitize: false
         };
 
         /**
@@ -90,6 +92,23 @@
           this.stripHtml = function (text) {
             return String(text).replace(/<[^>]+>/gm, '');
           };
+
+          /**
+           * Gets the value of the configuration parameter of CONVERTER specified by key
+           * @param {string} key The config parameter key
+           * @returns {*}
+           */
+          this.getOption = function (key) {
+            return converter.getOption(key);
+          };
+
+          /**
+           * Gets the converter configuration params
+           * @returns {*}
+           */
+          this.getOptions = function () {
+            return converter.getOptions();
+          };
         }
 
         // The object returned by service provider
@@ -99,36 +118,62 @@
       }
 
       /**
-       * AngularJS Directive to Md to HTML transformation
+       * @deprecated
+       * Legacy AngularJS Directive to Md to HTML transformation
        *
        * Usage example:
        * <div sd-model-to-html="markdownText" ></div>
        *
        * @param {showdown.Converter} $showdown
+       * @param {$sanitize} $sanitize
        * @param {$sce} $sce
        * @returns {*}
        */
-      function markdownToHtmlDirective($showdown, $sce) {
+      function sdModelToHtmlDirective($showdown, $sanitize, $sce) {
         return {
           restrict: 'A',
-          link: link,
+          link: getLinkFn($showdown, $sanitize, $sce),
           scope: {
             model: '=sdModelToHtml'
           }
         };
+      }
+
+      /**
+       * AngularJS Directive to Md to HTML transformation
+       *
+       * Usage example:
+       * <div markdown-to-html="markdownText" ></div>
+       *
+       * @param {showdown.Converter} $showdown
+       * @param {$sanitize} $sanitize
+       * @param {$sce} $sce
+       * @returns {*}
+       */
+      function markdownToHtmlDirective($showdown, $sanitize, $sce) {
+        return {
+          restrict: 'A',
+          link: getLinkFn($showdown, $sanitize, $sce),
+          scope: {
+            model: '=markdownToHtml'
+          }
+        };
+      }
 
-        function link(scope, element) {
+      function getLinkFn($showdown, $sanitize, $sce) {
+        return function (scope, element) {
           scope.$watch('model', function (newValue) {
-            var val;
+            var val,
+                showdownHTML;
             if (typeof newValue === 'string') {
-              var showdownHTML = $showdown.makeHtml(newValue);
-              val = $sce.trustAsHtml(showdownHTML);
+              showdownHTML = $showdown.makeHtml(newValue);
+              val = ($showdown.getOption('sanitize')) ? $sanitize(showdownHTML) : $sce.trustAsHtml(showdownHTML);
             } else {
               val = typeof newValue;
             }
             element.html(val);
           });
-        }
+        };
       }
 
       /**