Wetbikeboy2500 commented on issue #34191: URL: https://github.com/apache/superset/issues/34191#issuecomment-5003277521
I ran into this issue and have found what the problem is. The https://github.com/rehypejs/rehype-sanitize package is wrapper around [hast-util-sanitize](https://github.com/syntax-tree/hast-util-sanitize). For hast-util-sanitize, the relevant section is: > Instead of a single string in the array, which allows any property value for the field, you can use an array to allow several values. For example, input: ['type'] allows type set to any value on inputs. But input: [['type', 'checkbox', 'radio']] allows type when set to 'checkbox' or 'radio'. > >You can use regexes, so for example span: [['className', /^hljs-/]] allows any class that starts with hljs- on spans. > >When comma- or space-separated values are used (such as className), each value in is checked individually. For example, to allow certain classes on spans for syntax highlighting, use span: [['className', 'number', 'operator', 'token']]. This will allow 'number', 'operator', and 'token' classes, but drop others. When you look at the default schema, it is already defining with these types of attribute list restrictions for element like ul, ol, li, and a elements. I have verified this where the ul element will only accept the contains-task-list class. It is also why we see the class attribute exists on the elements, but their value is empty. https://github.com/syntax-tree/hast-util-sanitize/blob/main/lib/schema.js This does not seem to be accounted for on the superset side -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
