Why would you need to allow any attribute you don’t know? The ‘trick’ which has been known since the turn of the century is to have a whitelist of things to all

Why would you need to allow any attribute you don’t know? The ‘trick’ which has been known since the turn of the century is to have a whitelist of things to allow and block everything else. So you allow img tags with the attributes you know and drop everything else. And if it’s useful to have a prepared list of safe tags, why would that need to be provided by the browser? > It's not trivial to write a sanitizer that both works and it's useful While I would disagree with this claim, if it is true it is even more reason to not set this in stone by building it into browsers and instead provide a basic external library that makes the policy decisions that are useful to you. And of course this is what is going to happen anyway, because you can’t count on this always being available, so you need to include a library that provides this functionality in JavaScript if the browser doesn’t. Which is trivial because this doesn’t involve anything JavaScript doesn’t have access to.