logoalt Hacker News

evilpieyesterday at 5:22 PM1 replyview on HN

The HTML Sanitizer API has a subset of SVG that is allowed by the default configuration. It won't help you with sanitizing CSS at all however, style is simply not allowed by default.

https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...

https://developer.mozilla.org/en-US/docs/Web/API/HTML_Saniti...


Replies

Grokifytoday at 2:12 AM

Good reference, along with the article. I built a SVG sanitizer in Go and will look to these to make it more strict.