Skip to content

Instantly share code, notes, and snippets.

@webia1
Forked from kivikakk/whitelist.md
Created November 26, 2020 21:13
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save webia1/1836fe57ec2d19b79c5070476a4fe6b6 to your computer and use it in GitHub Desktop.
Save webia1/1836fe57ec2d19b79c5070476a4fe6b6 to your computer and use it in GitHub Desktop.
HTML sanitizer whitelist for user content on GitHub.com
  • Any allowed id and name attributes have "user-content-" prefixed to their value.
  • A maximum of 2 nested sub or sup tags are allowed.
  • A maximum of 10 nested ul or ol tags are allowed.
Allowed Element Allowed Attributes
All allowed elements abbr, accept, accept-charset, accesskey, action, align, alt, axis, border, cellpadding, cellspacing, char, charoff, charset, checked, clear, color, cols, colspan, compact, coords, datetime, dir, disabled, enctype, for, frame, headers, height, hreflang, hspace, id, ismap, itemprop, label, lang, maxlength, media, method, multiple, name, nohref, noshade, nowrap, open, prompt, readonly, rev, rows, rowspan, rules, scope, selected, shape, size, span, start, summary, tabindex, title, type, usemap, valign, value, vspace, width
a As above plus href (must be github-mac, github-windows, http, https, mailto or relative URL) — one of the following attributes is required: href, id, name
b As above
blockquote As above plus cite (must be http, https or relative URL)
br As above
code As above
dd As above
del As above plus cite (must be http, https or relative URL)
details As above
div As above plus itemscope, itemtype
dl As above
dt As above
em As above
h1 As above
h2 As above
h3 As above
h4 As above
h5 As above
h6 As above
hr As above
i As above
img As above plus longdesc (must be http, https or relative URL), src (must be http, https or relative URL)
ins As above plus cite (must be http, https or relative URL)
kbd As above
li As above
ol As above
p As above
pre As above
q As above plus cite (must be http, https or relative URL)
rp As above
rt As above
ruby As above
s As above
samp As above
span As above
strike As above
strong As above
sub As above
summary As above
sup As above
table As above
tbody As above
td As above
tfoot As above
th As above
thead As above
tr As above
tt As above
ul As above
var As above
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment