@@ -814,24 +814,18 @@ <h3 class="heading settled" data-level="2.3" id="config"><span class="secno">2.3
814
814
elements. Using both types is possible, but is probably of little practical
815
815
use. The same applies to < code > allowAttributes</ code > and < code > dropAttributes</ code > .</ p >
816
816
< p > Examples:</ p >
817
- < pre class ="language-js highlight "> < c- a > const</ c- > sample < c- o > =</ c- > < c- u > "Some text <b> <i> with</i> </b> <blink> tags</blink> ."</ c- > < c- p > ;</ c- >
818
-
819
- < c- c1 > // "Some text <b> with</b> text tags."</ c- >
820
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowElements< c- o > :</ c- > < c- p > [</ c- > < c- u > "b"</ c- > < c- p > ]).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
821
-
822
- < c- c1 > // "Some text <i> with</i> <blink> tags</blink> ."</ c- >
823
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > blockElements< c- o > :</ c- > < c- p > [</ c- > < c- u > "b"</ c- > < c- p > ]).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
824
-
825
- < c- c1 > // "Some text <blink> tags</blink> ."</ c- >
826
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > dropElements< c- o > :</ c- > < c- p > [</ c- > < c- u > "b"</ c- > < c- p > ]).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
827
-
828
- < c- c1 > // Note: The default configuration handles XSS-relevant input:</ c- >
829
-
830
- < c- c1 > // Non-scripting input will be passed through:</ c- >
831
- < c- k > new</ c- > Sanitizer< c- p > ().</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- > < c- c1 > // Will output sample unmodified.</ c- >
832
-
833
- < c- c1 > // Scripts will be blocked: "abc alert(1) def"</ c- >
834
- < c- k > new</ c- > Sanitizer< c- p > ().</ c- > sanitizeToString< c- p > (</ c- > < c- u > "abc <script> alert(1)</script> def"</ c- > < c- p > );</ c- >
817
+ < pre class ="language-js highlight "> < c- a > const</ c- > sample < c- o > =</ c- > < c- u > "Some text <b> <i> with</i> </b> <blink> tags</blink> ."</ c- > < c- p > ;</ c- >
818
+ < c- c1 > // "Some text <b> with</b> text tags."</ c- >
819
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowElements< c- o > :</ c- > < c- p > [</ c- > < c- u > "b"</ c- > < c- p > ]).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
820
+ < c- c1 > // "Some text <i> with</i> <blink> tags</blink> ."</ c- >
821
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > blockElements< c- o > :</ c- > < c- p > [</ c- > < c- u > "b"</ c- > < c- p > ]).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
822
+ < c- c1 > // "Some text <blink> tags</blink> ."</ c- >
823
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > dropElements< c- o > :</ c- > < c- p > [</ c- > < c- u > "b"</ c- > < c- p > ]).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
824
+ < c- c1 > // Note: The default configuration handles XSS-relevant input:</ c- >
825
+ < c- c1 > // Non-scripting input will be passed through:</ c- >
826
+ < c- k > new</ c- > Sanitizer< c- p > ().</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- > < c- c1 > // Will output sample unmodified.</ c- >
827
+ < c- c1 > // Scripts will be blocked: "abc alert(1) def"</ c- >
828
+ < c- k > new</ c- > Sanitizer< c- p > ().</ c- > sanitizeToString< c- p > (</ c- > < c- u > "abc <script> alert(1)</script> def"</ c- > < c- p > );</ c- >
835
829
</ pre >
836
830
< h4 class ="heading settled " data-level ="2.3.1 " id ="attr-match-list "> < span class ="secno "> 2.3.1. </ span > < span class ="content "> Attribute Match Lists</ span > < a class ="self-link " href ="#attr-match-list "> </ a > </ h4 >
837
831
< p > An < dfn class ="dfn-paneled " data-dfn-type ="dfn " data-noexport id ="attribute-match-list "> attribute match list</ dfn > is a map of attribute names to element names,
@@ -841,22 +835,17 @@ <h4 class="heading settled" data-level="2.3.1" id="attr-match-list"><span class=
841
835
< pre class ="idl highlight def "> < c- b > typedef</ c- > < a data-link-type ="dfn " href ="https://heycam.github.io/webidl/#idl-record " id ="ref-for-idl-record "> < c- b > record</ c- > </ a > << a class ="idl-code " data-link-type ="interface " href ="https://heycam.github.io/webidl/#idl-DOMString " id ="ref-for-idl-DOMString⑤ "> < c- b > DOMString</ c- > </ a > , < a data-link-type ="dfn " href ="https://heycam.github.io/webidl/#idl-sequence " id ="ref-for-idl-sequence③ "> < c- b > sequence</ c- > </ a > << a class ="idl-code " data-link-type ="interface " href ="https://heycam.github.io/webidl/#idl-DOMString " id ="ref-for-idl-DOMString⑥ "> < c- b > DOMString</ c- > </ a > > > < dfn class ="dfn-paneled idl-code " data-dfn-type ="typedef " data-export id ="typedefdef-attributematchlist "> < code > < c- g > AttributeMatchList</ c- > </ code > </ dfn > ;
842
836
</ pre >
843
837
< p > Examples for attributes and attribute match lists:</ p >
844
- < pre class ="language-js highlight "> < c- a > const</ c- > sample < c- o > =</ c- > < c- u > "<span id='span1' class='theclass' style='font-weight: bold'> hello</span> "</ c- > < c- p > ;</ c- >
845
-
846
- < c- c1 > // Allow only <span style> : "<span style='font-weight: bold'> ...</span> "</ c- >
847
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "style"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "span"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
848
-
849
- < c- c1 > // Allow style, but not on span: "<span> ...</span> "</ c- >
850
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "style"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "div"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
851
-
852
- < c- c1 > // Allow style on any elements: "<span style='font-weight: bold'> ...</span> "</ c- >
853
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "style"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "*"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
854
-
855
- < c- c1 > // Block <span id> : "<span class='theclass' style='font-weight: bold'> ...</span> ";</ c- >
856
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > blockAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "id"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "span"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
857
-
858
- < c- c1 > // Block id, everywhere: "<span class='theclass' style='font-weight: bold'> ...</span> ";</ c- >
859
- < c- k > new</ c- > Sanitizer< c- p > ({</ c- > blockAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "id"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "*"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
838
+ < pre class ="language-js highlight "> < c- a > const</ c- > sample < c- o > =</ c- > < c- u > "<span id='span1' class='theclass' style='font-weight: bold'> hello</span> "</ c- > < c- p > ;</ c- >
839
+ < c- c1 > // Allow only <span style> : "<span style='font-weight: bold'> ...</span> "</ c- >
840
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "style"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "span"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
841
+ < c- c1 > // Allow style, but not on span: "<span> ...</span> "</ c- >
842
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "style"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "div"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
843
+ < c- c1 > // Allow style on any elements: "<span style='font-weight: bold'> ...</span> "</ c- >
844
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > allowAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "style"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "*"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
845
+ < c- c1 > // Block <span id> : "<span class='theclass' style='font-weight: bold'> ...</span> ";</ c- >
846
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > blockAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "id"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "span"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
847
+ < c- c1 > // Block id, everywhere: "<span class='theclass' style='font-weight: bold'> ...</span> ";</ c- >
848
+ < c- k > new</ c- > Sanitizer< c- p > ({</ c- > blockAttributes< c- o > :</ c- > < c- p > {</ c- > < c- u > "id"</ c- > < c- o > :</ c- > < c- p > [</ c- > < c- u > "*"</ c- > < c- p > ]}}).</ c- > sanitizeToString< c- p > (</ c- > sample< c- p > );</ c- >
860
849
</ pre >
861
850
< h3 class ="heading settled " data-level ="2.4 " id ="algorithms "> < span class ="secno "> 2.4. </ span > < span class ="content "> Algorithms</ span > < a class ="self-link " href ="#algorithms "> </ a > </ h3 >
862
851
< div class ="algorithm " data-algorithm ="sanitize ">
0 commit comments