Skip to content

Instantly share code, notes, and snippets.

View joshuakraemer's full-sized avatar

Joshua Krämer joshuakraemer

View GitHub Profile
@kivikakk
kivikakk / whitelist.md
Created November 16, 2018 02:18
HTML sanitizer whitelist for user content on GitHub.com
  • Any allowed id and name attributes have "user-content-" prefixed to their value.
  • A maximum of 2 nested sub or sup tags are allowed.
  • A maximum of 10 nested ul or ol tags are allowed.
Allowed Element Allowed Attributes
All allowed elements abbr, accept, accept-charset, accesskey, action, align, alt, axis, border, cellpadding, cellspacing, char, charoff, charset, checked, clear, color, cols, colspan, compact, coords, datetime, dir, disabled, enctype, for, frame, headers, height, hreflang, hspace, id, ismap, itemprop, label, lang, maxlength, media, method, multiple, name, nohref, noshade, nowrap, open, prompt, readonly, rev, rows, rowspan, rules, scope, selected, shape, size, span, start, summary, tabindex, title, type, usemap, valign, value, vspace, width
a As above plus href (must be github-mac, github-windows, http,