Stroke and stroke-width are considered invalid

OWASP / java-html-sanitizer

Takes third-party HTML and produces HTML that is safe to embed in your web application. Fast and easy to configure.

Other

834 stars 209 forks source link

Open mb34890 opened 2 years ago

mb34890 commented 2 years ago

Hi,

An expression like the following is considered invalid:

<path style="stroke-width:4;stroke:rgb(138,232,242)"></path>

Either stroke or stroke-width are not accepted in a style.

Is it on purpose or a bug?

Thanks!

Mircea

subbudvk commented 8 months ago

@mb34890 What is your policy ?