https://wiki.whatwg.org/api.php?action=feedcontributions&feedformat=atom&user=Jabley
WHATWG Wiki - User contributions [en]
2026-04-05T17:38:54Z
User contributions
MediaWiki 1.39.3
https://wiki.whatwg.org/index.php?title=Sanitization_rules&diff=2394
Sanitization rules
2007-08-07T19:32:40Z
<p>Jabley: /* URI protocols */ Added wtai and tel protocols, on the presumption that phones will be capable of viewing html5</p>
<hr />
<div>This page was initially seeded with the sanitization lists and rules implemented by the [http://code.google.com/p/html5lib/ html5lib] sanitizer, which in turn was based on [http://golem.ph.utexas.edu/instiki/show/HomePage Jacques Distler's branch of Instiki], which in turn was based on the sanitization logic in the [http://www.feedparser.org/ Universal Feed Parser].<br />
<br />
It is hoped that others will add, update, and extend this list based on their experiences in their own products, and furthermore that some will update their products based on these lists.<br />
<br />
As a suggestion but not as a requirement: people who do update their products to reflect information from this list are encouraged to add a link to this page as a comment in the hopes that it will encourage subsequent maintainers to keep this page up to date.<br />
<br />
=== Acceptable Elements ===<br />
<br />
* a<br />
* abbr<br />
* acronym<br />
* address<br />
* area<br />
* b<br />
* big<br />
* blockquote<br />
* br<br />
* button<br />
* caption<br />
* center<br />
* cite<br />
* code<br />
* col<br />
* colgroup<br />
* dd<br />
* del<br />
* dfn<br />
* dir<br />
* div<br />
* dl<br />
* dt<br />
* em<br />
* fieldset<br />
* font<br />
* form<br />
* h1<br />
* h2<br />
* h3<br />
* h4<br />
* h5<br />
* h6<br />
* hr<br />
* i<br />
* img<br />
* input<br />
* ins<br />
* kbd<br />
* label<br />
* legend<br />
* li<br />
* map<br />
* menu<br />
* ol<br />
* optgroup<br />
* option<br />
* p<br />
* pre<br />
* q<br />
* s<br />
* samp<br />
* select<br />
* small<br />
* span<br />
* strike<br />
* strong<br />
* sub<br />
* sup<br />
* table<br />
* tbody<br />
* td<br />
* textarea<br />
* tfoot<br />
* th<br />
* thead<br />
* tr<br />
* tt<br />
* u<br />
* ul<br />
* var<br />
<br />
==== mathml Elements ====<br />
<br />
* maction<br />
* math<br />
* merror<br />
* mfrac<br />
* mi<br />
* mmultiscripts<br />
* mn<br />
* mo<br />
* mover<br />
* mpadded<br />
* mphantom<br />
* mprescripts<br />
* mroot<br />
* mrow<br />
* mspace<br />
* msqrt<br />
* mstyle<br />
* msub<br />
* msubsup<br />
* msup<br />
* mtable<br />
* mtd<br />
* mtext<br />
* mtr<br />
* munder<br />
* munderover<br />
* none<br />
<br />
==== svg Elements ====<br />
<br />
* a<br />
* animate<br />
* animateColor<br />
* animateMotion<br />
* animateTransform<br />
* circle<br />
* defs<br />
* desc<br />
* ellipse<br />
* font-face<br />
* font-face-name<br />
* font-face-src<br />
* g<br />
* glyph<br />
* hkern<br />
* image<br />
* linearGradient<br />
* line<br />
* marker<br />
* metadata<br />
* missing-glyph<br />
* mpath<br />
* path<br />
* polygon<br />
* polyline<br />
* radialGradient<br />
* rect<br />
* set<br />
* stop<br />
* svg<br />
* switch<br />
* text<br />
* title<br />
* tspan<br />
* use<br />
<br />
=== Acceptable Attributes ===<br />
<br />
* abbr<br />
* accept<br />
* accept-charset<br />
* accesskey<br />
* action<br />
* align<br />
* alt<br />
* axis<br />
* border<br />
* cellpadding<br />
* cellspacing<br />
* char<br />
* charoff<br />
* charset<br />
* checked<br />
* cite<br />
* class<br />
* clear<br />
* cols<br />
* colspan<br />
* color<br />
* compact<br />
* coords<br />
* datetime<br />
* dir<br />
* disabled<br />
* enctype<br />
* for<br />
* frame<br />
* headers<br />
* height<br />
* href<br />
* hreflang<br />
* hspace<br />
* id<br />
* ismap<br />
* label<br />
* lang<br />
* longdesc<br />
* maxlength<br />
* media<br />
* method<br />
* multiple<br />
* name<br />
* nohref<br />
* noshade<br />
* nowrap<br />
* prompt<br />
* readonly<br />
* rel<br />
* rev<br />
* rows<br />
* rowspan<br />
* rules<br />
* scope<br />
* selected<br />
* shape<br />
* size<br />
* span<br />
* src<br />
* start<br />
* style<br />
* summary<br />
* tabindex<br />
* target<br />
* title<br />
* type<br />
* usemap<br />
* valign<br />
* value<br />
* vspace<br />
* width<br />
* xml:lang<br />
<br />
==== mathml Attributes ====<br />
<br />
* actiontype<br />
* align<br />
* columnalign<br />
* columnalign<br />
* columnalign<br />
* columnlines<br />
* columnspacing<br />
* columnspan<br />
* depth<br />
* display<br />
* displaystyle<br />
* equalcolumns<br />
* equalrows<br />
* fence<br />
* fontstyle<br />
* fontweight<br />
* frame<br />
* height<br />
* linethickness<br />
* lspace<br />
* mathbackground<br />
* mathcolor<br />
* mathvariant<br />
* mathvariant<br />
* maxsize<br />
* minsize<br />
* other<br />
* rowalign<br />
* rowalign<br />
* rowalign<br />
* rowlines<br />
* rowspacing<br />
* rowspan<br />
* rspace<br />
* scriptlevel<br />
* selection<br />
* separator<br />
* stretchy<br />
* width<br />
* width<br />
* xlink:href<br />
* xlink:show<br />
* xlink:type<br />
* xmlns<br />
* xmlns:xlink<br />
<br />
==== svg Attributes ====<br />
<br />
* accent-height<br />
* accumulate<br />
* additive<br />
* alphabetic<br />
* arabic-form<br />
* ascent<br />
* attributeName<br />
* attributeType<br />
* baseProfile<br />
* bbox<br />
* begin<br />
* by<br />
* calcMode<br />
* cap-height<br />
* class<br />
* color<br />
* color-rendering<br />
* content<br />
* cx<br />
* cy<br />
* d<br />
* dx<br />
* dy<br />
* descent<br />
* display<br />
* dur<br />
* end<br />
* fill<br />
* fill-rule<br />
* font-family<br />
* font-size<br />
* font-stretch<br />
* font-style<br />
* font-variant<br />
* font-weight<br />
* from<br />
* fx<br />
* fy<br />
* g1<br />
* g2<br />
* glyph-name<br />
* gradientUnits<br />
* hanging<br />
* height<br />
* horiz-adv-x<br />
* horiz-origin-x<br />
* id<br />
* ideographic<br />
* k<br />
* keyPoints<br />
* keySplines<br />
* keyTimes<br />
* lang<br />
* marker-end<br />
* marker-mid<br />
* marker-start<br />
* markerHeight<br />
* markerUnits<br />
* markerWidth<br />
* mathematical<br />
* max<br />
* min<br />
* name<br />
* offset<br />
* opacity<br />
* orient<br />
* origin<br />
* overline-position<br />
* overline-thickness<br />
* panose-1<br />
* path<br />
* pathLength<br />
* points<br />
* preserveAspectRatio<br />
* r<br />
* refX<br />
* refY<br />
* repeatCount<br />
* repeatDur<br />
* requiredExtensions<br />
* requiredFeatures<br />
* restart<br />
* rotate<br />
* rx<br />
* ry<br />
* slope<br />
* stemh<br />
* stemv<br />
* stop-color<br />
* stop-opacity<br />
* strikethrough-position<br />
* strikethrough-thickness<br />
* stroke<br />
* stroke-dasharray<br />
* stroke-dashoffset<br />
* stroke-linecap<br />
* stroke-linejoin<br />
* stroke-miterlimit<br />
* stroke-opacity<br />
* stroke-width<br />
* systemLanguage<br />
* target<br />
* text-anchor<br />
* to<br />
* transform<br />
* type<br />
* u1<br />
* u2<br />
* underline-position<br />
* underline-thickness<br />
* unicode<br />
* unicode-range<br />
* units-per-em<br />
* values<br />
* version<br />
* viewBox<br />
* visibility<br />
* width<br />
* widths<br />
* x<br />
* x-height<br />
* x1<br />
* x2<br />
* xlink:actuate<br />
* xlink:arcrole<br />
* xlink:href<br />
* xlink:role<br />
* xlink:show<br />
* xlink:title<br />
* xlink:type<br />
* xml:base<br />
* xml:lang<br />
* xml:space<br />
* xmlns<br />
* xmlns:xlink<br />
* y<br />
* y1<br />
* y2<br />
* zoomAndPan<br />
<br />
=== CSS Rules ===<br />
<br />
First <code>urls</code> matching the following regular expression are removed:<br />
<pre>url\s*\(\s*[^\s)]+?\s*\)\s*</pre><br />
<br />
The style strings that don't match the following are deemed obfuscated, and ignored entirely:<br />
<pre>^([:,;#%.\sa-zA-Z0-9!]|\w-\w|'[\s\w]+'|"[\s\w]+"|\([\d,\s]+\))*$</pre><br />
<pre>^(\s*[-\w]+\s*:\s*[^:;]*(;|$))*$</pre><br />
<br />
==== style Properties ====<br />
<br />
* azimuth<br />
* background-color<br />
* border-bottom-color<br />
* border-collapse<br />
* border-color<br />
* border-left-color<br />
* border-right-color<br />
* border-top-color<br />
* clear<br />
* color<br />
* cursor<br />
* direction<br />
* display<br />
* elevation<br />
* float<br />
* font<br />
* font-family<br />
* font-size<br />
* font-style<br />
* font-variant<br />
* font-weight<br />
* height<br />
* letter-spacing<br />
* line-height<br />
* overflow<br />
* pause<br />
* pause-after<br />
* pause-before<br />
* pitch<br />
* pitch-range<br />
* richness<br />
* speak<br />
* speak-header<br />
* speak-numeral<br />
* speak-punctuation<br />
* speech-rate<br />
* stress<br />
* text-align<br />
* text-decoration<br />
* text-indent<br />
* unicode-bidi<br />
* vertical-align<br />
* voice-family<br />
* volume<br />
* white-space<br />
* width<br />
<br />
==== style Property Values ====<br />
<br />
* auto<br />
* aqua<br />
* black<br />
* block<br />
* blue<br />
* bold<br />
* both<br />
* bottom<br />
* brown<br />
* center<br />
* collapse<br />
* dashed<br />
* dotted<br />
* fuchsia<br />
* gray<br />
* green<br />
* !important<br />
* italic<br />
* left<br />
* lime<br />
* maroon<br />
* medium<br />
* none<br />
* navy<br />
* normal<br />
* nowrap<br />
* olive<br />
* pointer<br />
* purple<br />
* red<br />
* right<br />
* solid<br />
* silver<br />
* teal<br />
* top<br />
* transparent<br />
* underline<br />
* white<br />
* yellow<br />
<br />
==== svg sytle Properties ====<br />
<br />
* fill<br />
* fill-opacity<br />
* fill-rule<br />
* stroke<br />
* stroke-width<br />
* stroke-linecap<br />
* stroke-linejoin<br />
* stroke-opacity<br />
<br />
=== URIs ===<br />
==== Attributes whose value is a URI ====<br />
<br />
* href<br />
* src<br />
* cite<br />
* action<br />
* longdesc<br />
* xlink:href<br />
* xml:base<br />
<br />
==== URI protocols ====<br />
<br />
* afs<br />
* aim<br />
* callto<br />
* ed2k<br />
* feed<br />
* ftp<br />
* gopher<br />
* http<br />
* https<br />
* irc<br />
* mailto<br />
* news<br />
* nntp<br />
* rsync<br />
* rtsp<br />
* sftp<br />
* ssh<br />
* tag<br />
* tel<br />
* telnet<br />
* urn<br />
* webcal<br />
* wtai<br />
* xmpp</div>
Jabley