Fixing markdown vulnerabilities.

Thanks to @tivie 's article, found that this extension did not filter XSS attacks that were created using markdown syntax.  Fix was to have this extension be an 'output' type extension, so that it ran after the markdown was rendered against the final HTML.

This fixes #4.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "showdown-xss-filter",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "XSS filter extension for showdown",
   "keywords": [
     "markdown",
@@ -21,5 +21,13 @@
   "main": "./showdown-xss-filter.js",
   "dependencies": {
     "xss": "0.2.x"
+  },
+  "devDependencies": {
+    "expect.js": "~0.3.1",
+    "mocha": "^2.2.4",
+    "showdown": "~1.0.2"
+  },
+  "scripts": {
+    "test": "mocha"
   }
 }

showdown-xss-filter.js

@@ -15,7 +15,7 @@
   var xssfilter = function (converter) {
     return [
       {
-        type: "lang",
+        type: "output",
         filter: function(text) {
           return filterXSS(text);
         }

test/test.js

@@ -0,0 +1,34 @@
+var expect = require('expect.js'),
+    filter = require('../showdown-xss-filter'),
+    showdown = require('showdown');
+
+// tests to ensure resolved issues are not re-introduced
+describe('issues', function() {
+
+  // https://github.com/VisionistInc/showdown-xss-filter/issues/4
+  describe('#4: filters html generated by showdown rendering html', function() {
+
+    var converter;
+
+    beforeEach(function(done) {
+      converter = new showdown.Converter({extensions: [filter]});
+      done();
+    });
+
+    it("filters XSS attacks in markdown links", function(done) {
+      var markdown = "[test](javascript:alert('xss'))";
+      var converted = converter.makeHtml(markdown);
+
+      expect(converted).to.eql('<p><a href>test</a></p>');
+      done();
+    });
+
+    it("properly filters mixed markdown/html attack using blockquotes", function(done) {
+      var markdown = '> hello <a name="n"\n> href="javascript:alert(\'xss\')">*you*</a>';
+      var converted = converter.makeHtml(markdown);
+
+      expect(converted).to.eql('<blockquote>\n  <p>hello <a href><em>you</em></a></p>\n</blockquote>');
+      done();
+    });
+  });
+});