editor.insert could not insert custom html tags

[fedot199614]

i try to insert custom html tag <lottie-player>Test</lottie-player> but it inserts only text - Test.
olso i try wysiwygEditorInsertHtml - but no effect.
text area are emty - <p><br></p>

[samclarke]

Thanks for reporting!

This is caused by the filtering done to prevent XSS. Before HTML is inserted into the editor it's filtered using DOMPurify. It looks like DOMPurify removes all custom elements by default.

Fixing this will probably require a new configuration option to specify allowed custom elements.

[fedot199614]

thanks, i add in my SCEditor build new options allowedTags, allowedAttributes
and make something like this
` /**
* Sanitize HTML to avoid XSS
*
* @param {string} html
* @return {string} html
* @Private
*/
function sanitize(html) {

	const allowedTags = ['iframe'].concat(options.allowedTags);
	const allowedAttr = ['allowfullscreen', 'frameborder', 'target']
		.concat(options.allowedAttributes);

	return domPurify.sanitize(html, {
		ADD_TAGS: allowedTags,
		ADD_ATTR: allowedAttr
	});
};`

and it's works

[samclarke]

That looks great. If you want to make a PR, it can be merged into the code base.

[codertushar]

@samclarke @fedot199614 Please review my PR: #925
I need this ASAP. It is breaking my existing functionality when I moved to a newer version of SCEditor.