> Our approach is to remove unwanted tags and properties I'm no security guru, but isn't the best practice to have a whitelist of accepted elements rather than

> Our approach is to remove unwanted tags and properties I'm no security guru, but isn't the best practice to have a whitelist of accepted elements rather than a blacklist of prohibited elements?