2020700 - setHTML does not keep attributes which are allowed by the sanitizer

Status: RESOLVED INVALID

(Core :: DOM: Security, defect)

Description

[Hubert Boma Manilla (:bomsy)]

Attachment: testpage.html

Setting the attributes property seems to have no effect. The class attributes are not preserved in the output

const unsafeHTML = `
	<span class="foo">
  	    <span class="bar"></span>
        </span>
  `;
  
const sanitizer = new Sanitizer({ elements: ["span"], attributes: ["class"]});
target.setHTML(unsafeHTML, sanitizer);
console.log(target.innerHTML)

Actual Output

 <span>
    <span></span>
 </span>

Expected Output

 <span class="foo">
    <span class="bar"></span>
 </span>

Note: A test page is also attached

Comment 1

[Tom Schuster]

The second argument of setHTML is a dictionary, you need to use the key "sanitizer".

This works:

target.setHTML(unsafeHTML, {sanitizer});