diff --git a/frappe/tests/test_utils.py b/frappe/tests/test_utils.py
index e903c655b0..e68e8372af 100644
--- a/frappe/tests/test_utils.py
+++ b/frappe/tests/test_utils.py
@@ -254,6 +254,13 @@ class TestHTMLUtils(unittest.TestCase):
self.assertTrue("
Hello
" in clean)
self.assertTrue('text' in clean)
+ def test_sanitize_html(self):
+ from frappe.utils.html_utils import sanitize_html
+
+ clean = sanitize_html("
")
+ self.assertIn("ordered", clean)
+ self.assertNotIn("xyz", clean)
+
class TestValidationUtils(unittest.TestCase):
def test_valid_url(self):
diff --git a/frappe/utils/html_utils.py b/frappe/utils/html_utils.py
index b9d0e8dfe2..fa84170330 100644
--- a/frappe/utils/html_utils.py
+++ b/frappe/utils/html_utils.py
@@ -162,7 +162,13 @@ def sanitize_html(html, linkify=False):
+ mathml_elements
+ ["html", "head", "meta", "link", "body", "style", "o:p"]
)
- attributes = {"*": acceptable_attributes, "svg": svg_attributes}
+
+ def attributes_filter(tag, name, value):
+ if name.startswith("data-"):
+ return True
+ return name in acceptable_attributes
+
+ attributes = {"*": attributes_filter, "svg": svg_attributes}
styles = bleach_allowlist.all_styles
strip_comments = False