Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

There was a problem

You must be a member of this account.

This project is archived and is in readonly mode.

WhiteListSanitizer allows dt and dd but not dl

#2393

In /actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb there's this:

Specifies the default Set of tags that the

sanitize helper will allow unscathed.

self.allowed_tags = Set.new(%w(strong em b i p code pre tt samp kbd var sub sup dfn cite big small address hr br div span h1 h2 h3 h4 h5 h6 ul ol li dt dd abbr acronym a img blockquote del ins))

I can't think of any reason to allow dt and dd tags and not dl (in fact, stripping out the dl tags leaves you with invalid html), so I'm wondering if that's just an oversight.

Reported by Nancy McLaughlin · April 1st, 2009 @ 04:04 PM

State: resolved
Milestone: 2.x
Assigned to: nobody
Importance: none

Activity

  1. Jeff
    Jeff

    +1 there's no point in allowing dt and dd if you can't use dl.

    http://www.w3schools.com/TAGS/ta...

    see (simple) patch

    April 4th, 2009 @ 03:38 PM

  2. Jeff
    Jeff
    • Tag changed from bug, sanitize to bug, patch, sanitize

    April 5th, 2009 @ 03:17 AM

  3. Henrik Nyh
    Henrik Nyh
    • Tag changed from bug, patch, sanitize to bug, patch, sanitize, tiny

    +1

    April 5th, 2009 @ 03:30 PM

  4. Ryan Bigg
  5. Jeff
    Jeff
    • Tag changed from bug, patch, sanitize, tiny to bug, patch, sanitize, tiny, verified

    April 21st, 2009 @ 12:40 AM

  6. Repository
  7. Jennifer Luo
    Jennifer Luo
    • Importance changed from to

    Anothing missing tag u. It's not in allowed_tag

    October 5th, 2010 @ 03:44 PM