From cafd2c920db23fc1f7a2e2b6988d59d1a95e000b Mon Sep 17 00:00:00 2001 From: Faris Ansari Date: Mon, 8 Aug 2022 18:36:54 +0530 Subject: [PATCH] fix(sanitize-html): allow all data-* attrs --- frappe/utils/html_utils.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/frappe/utils/html_utils.py b/frappe/utils/html_utils.py index b9d0e8dfe2..fa84170330 100644 --- a/frappe/utils/html_utils.py +++ b/frappe/utils/html_utils.py @@ -162,7 +162,13 @@ def sanitize_html(html, linkify=False): + mathml_elements + ["html", "head", "meta", "link", "body", "style", "o:p"] ) - attributes = {"*": acceptable_attributes, "svg": svg_attributes} + + def attributes_filter(tag, name, value): + if name.startswith("data-"): + return True + return name in acceptable_attributes + + attributes = {"*": attributes_filter, "svg": svg_attributes} styles = bleach_allowlist.all_styles strip_comments = False