OnClick Removed from Tags

[sapiennervosa]

I've been trying to develop embedded tools in my wiki pages using JS but it seems that whenever I create a button with an 'onclick' property it gets stripped out when the page is rendered.

For example, this line in the editor:

Test OnClick

Is rendered in the browser as this:
Test OnClick

Is the cause of this some sort of sanitizing that occurs during rendering? If so, it greatly diminishes the usefulness of scripts. Is it possible to disable this behavior?

Wiki.js 2.5.274
Debian 11

[sherry0429]

same here

[choke-dev]

wiki.js seems to strip the linked function to the button
In editor:

In page:

[choke-dev]

it greatly diminishes the usefulness of scripts.

Although it is true that scripts are less useful, you are still able to do stuff like a unix timestamp to text conversion

[choke-dev]

@sapiennervosa, @sherry0429 After a little while of looking through the admin dashboard, i think i have solved this problem

1. Go to the Admin dashboard
2. Open the Rendering module
3. Under html -> html, Click Security
4. Disable Sanitize HTML

[DarkDau]

I know my response is a little late on this topic.
Since I had to search for a long time to find out that onclick is a victim of html sanitize, I am surprised. Because presumably https://www.npmjs.com/package/sanitize-html
is used, but the default there is that onclick is allowed.
Therefore my question, is it not possible to teach wiki.js to allow onclick without disabling the whole sanitize?
I'm using the docker Wiki.js 2.5.303