Skip to content

Give allow/disallow reason in a big long tables (see #354) #355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mozfreddyb wants to merge 6 commits into
base: main
Choose a base branch
from
Draft

Give allow/disallow reason in a big long tables (see #354) #355

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3a5c90f
Improve and update the existing Security Considerations - fixes #287
mozfreddyb Oct 31, 2025
7423640
review feedback - part 1
mozfreddyb Nov 3, 2025
c706019
no comma before because#
mozfreddyb Nov 3, 2025
e518c72
rewrite to ensure we include ideally all elements - part 1
mozfreddyb Nov 5, 2025
d65965d
reduce PR to defer tables of allowed/disallowed elements for a follow-up
mozfreddyb Nov 5, 2025
b51c5c8
showcase how we could reason about html/svg/mathml elements/attribute…
mozfreddyb Nov 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
reduce PR to defer tables of allowed/disallowed elements for a follow-up
  • Loading branch information
@mozfreddyb
mozfreddyb committed Nov 5, 2025
commit d65965d6f0be64a41f3a9ae975160fd3a4b5ee7a
171 changes: 1 addition & 170 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1544,183 +1544,14 @@ A more complete treatment of mXSS can be found in [[MXSS]].

## Elements and attributes not allowed in the default config ## {#default-disallowed-elements}

While the Sanitizer aims to disallow Cross-Site Scripting attacks, the default
While the Sanitizer aims to disallow Cross-Site Scripting attacks [[XSS]], the default
settings are a bit stricter and do not include elements that may change page
settings, layout or fetch resources from other origins. The following elements
can be allowed with a configuration, but the individual reasoning for disallowing
them by default is given below.

Some elements are disallowed for multiple reasons, the list below does NOT aim to be
exhaustive. The following list will only mention the most concerning capability as the
reason for not allowing an element by default. It does not list all of them.

See also: [[#security-considerations]].

### List of disallowed elements in the HTML namespace


: The `<a>` element is allowed, but some attributes are disallowed by default. These are:
:: The `target` attribute is not allowed because it may lead to unintended consequences (e.g., targeting existing frames).
:: The `download` attribute is not allowed because it could target content not intended for downloading.
:: The `referrerpolicy` attribute is not allowed because it can override site-specific settings.
:: The `rel` attribute is not allowed because it can claim ownership or relationship of the whole document.
:: The `ping` attribute is not allowed because it could notify an unintended third-party of the link being clicked.

: `<area>`
:: This element is not allowed because it requires a `<map>`, which is also not allowed.
: `<base>`
:: This element is not supported because it overrides the default base URL for all links in the document.


: `<link>`
:: This element is not allowed because it can set or modify global document state.

: `<map>`
:: This element is not allowed because images are not allowed by default.

: `<meta>`
:: This element is not allowed because it can set or modify global document state.

: `<noscript>`
:: This element is not allowed because it

: `<audio>`, `<canvas>`, `<embed>`, `<iframe>`, `<img>`, `<object>`, `<picture>`, `<source>, `<track>` `<video>`
:: These elements for embedding content are not allowed because it leads to HTTP requests to arbitrary hosts.

: `<datalist>`, `<form>`, `<label>`, `<input>`, `<fieldset>`, `<legend>`, `<textarea>`, `<button>`, `<select>`, `<option>`, `<optgroup>`, `<output>`, `<progress>`, `<select>`, <selectedcontent>
:: These form elements are disallowed, we do not expect them in user-controlled content.

: `<dialog>`, `<details>`, `<summary>`
:: These interactive elements are disallowed, we do not expect them in user-controlled content.

: `<style>``
:: This element is disallowed because it can change the layout of the page.

: `<template>`, `<slot>`,

TODO Freddy: Also add non-conforming when they are not supported? These would be https://html.spec.whatwg.org/#non-conforming-features


### List of disallowed elements in the MathML namespace

The `<math>` element and various additional elements are allowed.
The list and their reasoning for the inclusion can be found in [[SafeMathML]].

### List of disallowed elements in the SVG namespace

FIXME: What about svg `<a>`. It doesn't appear in our list of allowed elements. Why?

: `<animate>`
:: This element is disallowed because SVG animations can modify and set attributes on other elements.

: `<animateMotion>`
:: This element is disallowed because we do not allow SVG animations (see above).

: `<animateTransform>`
:: This element is disallowed because we do not allow SVG animations (see above).

: `<clipPath>´

TODO FREDDY: Do we want to group all filter effect elements (fe...) in one entry?

: `<feBlend>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feColorMatrix>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feComponentTransfer>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feComposite>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feConvolveMatrix>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feDiffuseLighting>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feDisplacementMap>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feDistantLight>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feDropShadow>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feFlood>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feFuncA>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feFuncB>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feFuncG>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feFuncR>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feGaussianBlur>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feImage>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feMerge>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feMergeNode>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feMorphology>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feOffset>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<fePointLight>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feSpecularLighting>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feSpotLight>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feTile>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<feTurbulence>`
:: This element is disallowed because we do not allow SVG filters (see `<filter>` below).
: `<filter>`
:: :: This elements is not allowed because it leads to HTTP requests to arbitrary hosts.


: `<image>`
:: This elements is not allowed because it leads to HTTP requests to arbitrary hosts.

: `<linearGradient>`
:: This element is disallowed because we do not allow SVG animations (see above).

: `<mask>`
:: This element is disallowed because we do not allow WHY?

: `<mpath>`
:: This element is disallowed because we do not allow SVG animations (see above).

: `<pattern>`
:: This elements is not allowed because it leads to HTTP requests to arbitrary hosts.



: `<radialGradient>`
:: This element is disallowed because we do not allow SVG animations (see above).

: The `<svg>` element is allowed, but some attributes are disallowed by default. These are:
:: The `src` attribute is not allowed because it leads to HTTP requests to arbitrary hosts.

: `<set>`
:: This element is disallowed because we do not allow SVG animations (see above).

: `<style>`
:: This element is disallowed because it can change the layout of the page.

: `<switch>`
:: This element is disallowed because it can dynamically query and identify the user's settings.

: `<symbol>`
:: This element is disallowed because we do not allow the `<use>` element.

: `<use>`
:: This element is disallowed because it leads to HTTP requests to arbitrary hosts.

: `<view>`
:: This element is disallowed because it can allow selectively switching what is displayed

TODO: Is svg:view actually a concern? From the surface, this looks like you can declare stuff to be switched, but not actually switch views. Maybe OK?



## Elements that are **never** allowed ## {#never-allowed}

Expand Down