Questions about what exactly is in the default configuration?

cure53 / DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

https://cure53.de/purify

Other

13.61k stars 695 forks source link

Questions about what exactly is in the default configuration? #916

Closed VentuzVictorPerez closed 5 months ago

VentuzVictorPerez commented 5 months ago

Hi there!

I understand that DOMPurify comes with a default configuration and that this configuration is quite flexible and one can change it according to one's needs.

What exactly is allowed / disallowed by the default configuration?

Thank you very much.

VentuzVictorPerez commented 5 months ago

I guess the answer can be found in attr.js and tags.js