Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid and missing HTML elements in the sanatizer #342

Closed
vanillajonathan opened this issue Dec 7, 2020 · 0 comments
Closed

Invalid and missing HTML elements in the sanatizer #342

vanillajonathan opened this issue Dec 7, 2020 · 0 comments
Labels

Comments

@vanillajonathan
Copy link

https://github.com/jch/html-pipeline/blob/master/lib/html/pipeline/sanitization_filter.rb#L44-L77

The sanatizer contains h7 and h8 which are not valid HTML elements. The HTML standard defines the heading elements h1, h2, h3, h4, h5 and h6.

Notably missing are the HTML5 elements bdi (bidirectional), progress and meter. Perhaps even output.

The sanitizer allows the attribute color, which I believe is only used in HTML4 for the font element (which is removed from HTML5). So it would make sense to either add the legacy font element to the allowed elements list or remove the color attribute from the allowed attributes list. The color attribute is not a global attribute.

The allowed HTML elements contains img but video and audio are absent.

@gjtorikian gjtorikian added the v3 label Feb 16, 2021
gjtorikian added a commit that referenced this issue Jan 26, 2023
gjtorikian added a commit that referenced this issue Jan 26, 2023
gjtorikian added a commit that referenced this issue Jan 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants