在 GitHub README.md 中嵌入 JavaScript
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/21340803/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Embed JavaScript in GitHub README.md
提问by Matt Smith
I want to embed a tweet in a GitHub README file. Markdown should support this, however when I add the code that is copied from the tweet the JavaScript doesn't get rendered.
我想在 GitHub README 文件中嵌入一条推文。Markdown 应该支持这一点，但是当我添加从推文复制的代码时，JavaScript 不会被呈现。
Example:
例子：
<blockquote>...</blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<blockquote>...</blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
Any ideas?
有任何想法吗？
采纳答案by coyotte508
Allowing javascript from third parties directly on a website has huge XSS attacks implications. Someone could use javascript code for example to grab the cookies associated to any visitor's github accounts and forward them to a malicious entity.
直接在网站上允许来自第三方的 javascript 具有巨大的 XSS 攻击影响。例如，有人可以使用 javascript 代码获取与任何访问者的 github 帐户相关联的 cookie，并将其转发给恶意实体。
There's also the nuisance potential, as having access to javascript means having access to the CPU of the visitor and being able to do things like pop-ups or blinking text.
还有潜在的麻烦，因为访问 javascript 意味着可以访问访问者的 CPU 并能够执行诸如弹出窗口或闪烁文本之类的操作。
As such it's natural that javascript isn't supported in READMEs. Markdown mayhave a way of doing it, but it'll never be allowed on a website like GitHub.
因此，自述文件中不支持 javascript 是很自然的。Markdown可能有办法做到这一点，但它永远不会在像 GitHub 这样的网站上被允许。
However, you can do it on your project's github page, if you have one, since it doesn't belong to the main github website and the domain is not the same.
但是，您可以在项目的github 页面上执行此操作，如果您有的话，因为它不属于主要 github 网站并且域也不相同。
回答by D1plo1d
As a follow up to coyotte508's answer (sorry, not enough points to reply directly):
作为coyotte508的回答的后续（抱歉，积分不够直接回复）：
If Github were to enable such a feature they could use iFrames as an effective measure against XSS in the same way ReadTheDocs does.
如果 Github 启用这样的功能，他们可以像 ReadTheDocs 一样使用 iFrames 作为对抗 XSS 的有效措施。
EDIT: Also you might want to check out readthedocs.org as an alternative to a Github README.md. They support embedding javascript in rst files.
编辑：您也可能想查看 readthedocs.org 作为 Github README.md 的替代品。它们支持在 rst 文件中嵌入 javascript。
