Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow <s> on sanitize markdown #3646

Merged
merged 4 commits into from
Dec 23, 2020

Conversation

corinagum
Copy link
Contributor

@corinagum corinagum commented Dec 21, 2020

Fixes #3565

Changelog Entry

Description

Previously, only (deprecated) <strike> was allowed via sanitize, but now this will allow <s> as well.

markdown text ~~strikethrough~~ will now render as <s>strikethrough</s>

Design

Specific Changes

Review Checklist

This section is for contributors to review your work.

  • Accessibility reviewed (tab order, content readability, alt text, color contrast)
  • Browser and platform compatibilities reviewed
  • CSS styles reviewed (minimal rules, no z-index)
  • Documents reviewed (docs, samples, live demo)
  • Internationalization reviewed (strings, unit formatting)
  • package.json and package-lock.json reviewed
  • Security reviewed (no data URIs, check for nonce leak)
  • Tests reviewed (coverage, legitimacy)

@compulim
Copy link
Contributor

Thanks for such simple tests, no need snapshots. 👍🏻

Could you add <del> and <ins> to the whitelist too?

<del> is new in HTML5 to strikethrough texts. <ins> to emphasize adding of text. Samples below:

This is <del>

This is <ins>

@corinagum
Copy link
Contributor Author

@compulim neither tag passes tests - looks like sanitize-html doesn't skip filtering <ins> and <del> even if they're added to allowedTags.

Filed an issue: apostrophecms/sanitize-html#449

no tests added for latest addition

@corinagum corinagum merged commit 6368e77 into microsoft:master Dec 23, 2020
@compulim compulim mentioned this pull request Mar 2, 2021
52 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Strikethrough (<s>) is removed on sanitize
2 participants