3 ms·
Wait why does the second example remove <blink> but the first one doesn't? (with apparently the same default/none configuration). Any rationale behind this? I'd
by franciscop 5y ago
Wait why does the second example remove <blink> but the first one doesn't? (with apparently the same default/none configuration). Any rationale behind this? I'd expect both to return the same HTML, just in different formats (string vs DOM nodes)
- Turing_Machine 5y agoYeah, I think that's some kind of typo.
- franciscop 5y agoThanks! Added a PR to the docs: https://github.com/mdn/content/pull/4757 https://github.com/mdn/content/pull/4757
- chrismorgan 5y agoThis is the correct output of the first example, confirmed in real Firefox (note also the two spaces near the end): "Some text <b><i>with</i></b> tags, including a rogue script def."
- franciscop 5y agoOh so you are saying `<blink>` is always removed? That's right, it seems if it's not in the "allowElements" it's dropped: https://wicg.github.io/sanitizer-api/#defaults https://wicg.github.io/sanitizer-api/#defaults Edit: corrected "allowAttributes" => "allowElements"
- chrismorgan 5y ago<blink> would be allowElements, not allowAttributes.