DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
This issue proposes a bug or lack of knowledge on DOMPurify?
Background & Context
The head/meta information gets stripped out. Here is an example snippet (yes I was pretty much whitelisting everything to see if I can get the content to not strip). I looked through the source code and researched and couldn't find anything that worked. It works fine without using DOMPurify.
Some HTML which is thrown at DOMPurify.
Contents of this https://techcrunch.com/2024/01/22/germanys-instagrid-which-uses-software-to-supercharge-portable-batteries-raises-95m
Background & Context
The head/meta information gets stripped out. Here is an example snippet (yes I was pretty much whitelisting everything to see if I can get the content to not strip). I looked through the source code and researched and couldn't find anything that worked. It works fine without using DOMPurify.
Bug
Input
Some HTML which is thrown at DOMPurify. Contents of this
https://techcrunch.com/2024/01/22/germanys-instagrid-which-uses-software-to-supercharge-portable-batteries-raises-95m
Given output
The output given by DOMPurify. (TRIMMED)
Expected output
The header with the author meta tags.
Feature
I was hoping to preserve the meta tags so when it gets sent to Readability.js, it can parse the meta information of the article.