554130 - Add MathML and SVG elements to the list of white-listed elements for the paranoid content sink for the HTML5 parser

Status: RESOLVED DUPLICATE of bug 482909

(Core :: DOM: Core & HTML, defect)

Description

[(no longer active)]

+++ This bug was initially created as a clone of Bug #554125 +++

The HTML5 parser will allow embedding several SVG and MathML elements inside HTML documents.  We should probably consider adding the safe ones to the white-list of paranoid fragment parser content sink.

We need a list of safe elements and attributes here.

Comment 1

[Henri Sivonen (:hsivonen)]

The current paranoid fragment sink will go away once bug 482909 is fixed.

The plan is to put the sanitizer between nsHtml5Tokenizer and nsHtml5TreeBuilder.

Comment 2

[(no longer active)]

(In reply to comment #1)
> The current paranoid fragment sink will go away once bug 482909 is fixed.
> 
> The plan is to put the sanitizer between nsHtml5Tokenizer and
> nsHtml5TreeBuilder.

Will it be implemented using a similar approach (white-listing tags and attributes, and adding extra checks for elements which pass the white-list)?

Comment 3

[Henri Sivonen (:hsivonen)]

(In reply to comment #2)
> Will it be implemented using a similar approach (white-listing tags and
> attributes, and adding extra checks for elements which pass the white-list)?

That's the plan, yes. (Are there other extra checks than checks on URLs?)

Comment 4

[Jim Michaels]

http://Jesusnjim.com/common/html5-tags.txt
this is a summary of the whatwg HTML5 elements, MathML 3.0 elements, SVG elements.

I am still working on SVG elements. MathML is done. HTML5 may have changed since I worked on it. what I don't know is if a javascript user/developer actually needs all the SVG IDL interface stuff I am including or not, or if this is for browser implementers only. If I don't have to include it, I won't. It just makes the document SO much larger and makes the summary so much noisier.
any advice you can give would be great.  the mathml spec can be found here:
http://www.w3.org/TR/2010/PR-MathML3-20100810/Overview.html
but I see now it has updated to here, so my summary may be out of date: 
http://www.w3.org/TR/MathML3/

Comment 5

[Henri Sivonen (:hsivonen)]

This happened already in bug 482909. While this isn't strictly a dupe, trying to find a way to close this is a reasonable way that indicates the change got made.