|
|
@ -53,7 +53,7 @@ tags to permit, denying the use and rendering of anything else, is:
|
|
|
|
`font`, `del`, `h1`, `h2`, `h3`, `h4`, `h5`, `h6`, `blockquote`, `p`,
|
|
|
|
`font`, `del`, `h1`, `h2`, `h3`, `h4`, `h5`, `h6`, `blockquote`, `p`,
|
|
|
|
`a`, `ul`, `ol`, `sup`, `sub`, `li`, `b`, `i`, `u`, `strong`, `em`,
|
|
|
|
`a`, `ul`, `ol`, `sup`, `sub`, `li`, `b`, `i`, `u`, `strong`, `em`,
|
|
|
|
`strike`, `code`, `hr`, `br`, `div`, `table`, `thead`, `tbody`, `tr`,
|
|
|
|
`strike`, `code`, `hr`, `br`, `div`, `table`, `thead`, `tbody`, `tr`,
|
|
|
|
`th`, `td`, `caption`, `pre`, `span`, `img`.
|
|
|
|
`th`, `td`, `caption`, `pre`, `span`, `img`, `details`, `summary`.
|
|
|
|
|
|
|
|
|
|
|
|
Not all attributes on those tags should be permitted as they may be
|
|
|
|
Not all attributes on those tags should be permitted as they may be
|
|
|
|
avenues for other disruption attempts, such as adding `onclick` handlers
|
|
|
|
avenues for other disruption attempts, such as adding `onclick` handlers
|
|
|
|