search

ezyang / htmlpurifier

Standards compliant HTML filter written in PHP
http://htmlpurifier.org
GNU Lesser General Public License v2.1
3.07k stars 327 forks source link

Add contenteditable attribute definition #332

Closed bytestream closed 2 years ago

bytestream commented 2 years ago

See https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/contenteditable

ezyang commented 2 years ago

This is OK. If we put this in the library proper, it needs to be gated the same way textarea is gated.

bytestream commented 2 years ago

I only actually want to allow false so maybe contenteditable="false can be permitted, and contenteditable="" or contenteditable="true" only permitted when HTML.Trusted is enabled?

ezyang commented 2 years ago

Sure. Though, if you only want false, I wonder why not just disallow the attribute entirely haha.

bytestream commented 2 years ago

The attribute has significance in wysiwyg editors. When htmlpurifier removes it, the editors behaviour differently :p

bytestream commented 2 years ago

How about that? :eyes: