3 ms·
> Traverse the HTML fragment and remove elements as configured. Well this is clearly wrong isn't it? You need a whitelist of elements, not a blacklist. That le
by IshKebab 11mo ago
> Traverse the HTML fragment and remove elements as configured.
Well this is clearly wrong isn't it? You need a whitelist of elements, not a blacklist. That lesson is at least 2 decades old.
- jkrems 11mo agoI mean... "as configured" can me either an allow OR a denylist. That sentence doesn't really prescribe doing it one way or the other..? You have to parse the denylisted elements because they will affect the rest of the parse, so you _have_ to remove them afterwards in the general case.
- IshKebab 11mo agoLooks like it supports both actually: https://wicg.github.io/sanitizer-api/#sanitization https://wicg.github.io/sanitizer-api/#sanitization That's better than only supporting `removeElements`, but it really shouldn't support it at all.