gjtorikian / html-pipeline

HTML processing filters and utilities
MIT License
2.27k stars 382 forks source link

Invalid and missing HTML elements in the sanatizer #342

Closed vanillajonathan closed 1 year ago

vanillajonathan commented 3 years ago

https://github.com/jch/html-pipeline/blob/master/lib/html/pipeline/sanitization_filter.rb#L44-L77

The sanatizer contains h7 and h8 which are not valid HTML elements. The HTML standard defines the heading elements h1, h2, h3, h4, h5 and h6.

Notably missing are the HTML5 elements bdi (bidirectional), progress and meter. Perhaps even output.

The sanitizer allows the attribute color, which I believe is only used in HTML4 for the font element (which is removed from HTML5). So it would make sense to either add the legacy font element to the allowed elements list or remove the color attribute from the allowed attributes list. The color attribute is not a global attribute.

The allowed HTML elements contains img but video and audio are absent.