From 228fcb8175c41311c46556495bf0655952001584 Mon Sep 17 00:00:00 2001 From: Travis Ralston Date: Mon, 5 Apr 2021 20:23:15 -0600 Subject: [PATCH] Allow
and in suggested HTML subset Specs [MSC2184](https://github.com/matrix-org/matrix-doc/pull/2184) Based on https://github.com/matrix-org/matrix-doc/pull/3094 --- content/client-server-api/modules/instant_messaging.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/client-server-api/modules/instant_messaging.md b/content/client-server-api/modules/instant_messaging.md index 8e6df01d..3a933a93 100644 --- a/content/client-server-api/modules/instant_messaging.md +++ b/content/client-server-api/modules/instant_messaging.md @@ -53,7 +53,7 @@ tags to permit, denying the use and rendering of anything else, is: `font`, `del`, `h1`, `h2`, `h3`, `h4`, `h5`, `h6`, `blockquote`, `p`, `a`, `ul`, `ol`, `sup`, `sub`, `li`, `b`, `i`, `u`, `strong`, `em`, `strike`, `code`, `hr`, `br`, `div`, `table`, `thead`, `tbody`, `tr`, -`th`, `td`, `caption`, `pre`, `span`, `img`. +`th`, `td`, `caption`, `pre`, `span`, `img`, `details`, `summary`. Not all attributes on those tags should be permitted as they may be avenues for other disruption attempts, such as adding `onclick` handlers