2 ms·
I'm not against this, it can be used to replace lots of custom parsing for WYSIWYG editors that paste HTML from the clipboard (for example what happens when you
by slver 5y ago
I'm not against this, it can be used to replace lots of custom parsing for WYSIWYG editors that paste HTML from the clipboard (for example what happens when you copy content from Word, or from a site).
But it seems awfully underspecified. There's no single way to "sanitize" HTML. It's essentially a filter. So we need a way to control what's filtered.
We need a whitelist of elements, attributes, etc. for this to be useful in practice.
I believe a better name for this would be "NormalizeHTML" (think HTMLTidy), and accept a filter specification.
- evilpie 5y agoThe Santizer constructor can take a list of allowed elements etc.: https://developer.mozilla.org/en-US/docs/Web/API/Sanitizer/Sanitizer https://developer.mozilla.org/en-US/docs/Web/API/Sanitizer/S...
- slver 5y agoOh I see, thanks. It's a good start, but the attributes should be specified both globally and per node type, I don't see this. Also a blacklist (the "drop" variations) is a really bad idea.
- lyxsus 5y agoIf you open specification linked to that page ( https://wicg.github.io/sanitizer-api/#sanitizer-api https://wicg.github.io/sanitizer-api/#sanitizer-api ), you'll see that Sanitizer constructor accepts config param, that does exactly that and will probably extended before spec is ready.