Allow all the attribute for an allowed tag

[dingjiedanielyang]

This issue proposes a feature that is desired

Background & Context

We are using Dompurify to sanitize our HTML document. We want to keep all the attribute of the and tag by configuring
var clean = DOMPurify.sanitize(dirty, {WHOLE_DOCUMENT: true,ADD_TAGS: ['meta','link']});

It seems that some attribute of these two elements are filtered out. Is there a way to handle it without using ADD_ATTR feature. The attribute we want to keep is safe in and , but may not safe in other elements. That is why we don't want to use ADD_ATTR feature.

Thanks

[cure53]

Heya, what is that attribute? Is is by chance a standard attribute we can permit in general?

[dingjiedanielyang]

Wow, that is a quick reply. The attribute name is content.

[cure53]

@ygjdingjie-changed haha thanks :D

So, if it is just one attribute, I would propose to add it via config. It feels a bit risky to handle it without that - given that both LINK and META can introduce XSS attacks.

[dingjiedanielyang]

Cool. That was my original question. I just want to add this attribute for <meta> and <link> tag. I don't want to massively allow them for other tags. Is there a way?

[cure53]

Ah, I understand. The best way if you want to allow the attribute for only one tag is to use a hook. With that, you can do it in 5 lines of code or less.

[dingjiedanielyang]

Could you please share one example with me? I am not sure that I may use the hook correctly

[cure53]

This one might be helpful:

https://github.com/cure53/DOMPurify/blob/master/demos/hooks-target-blank-demo.html

[dingjiedanielyang]

Cool. Thank you.