Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add additional acceptable css properties #283

Conversation

factcondenser
Copy link

@factcondenser factcondenser commented May 8, 2024

picking up where #258 left off

@flavorjones flavorjones marked this pull request as ready for review May 13, 2024 15:40
@flavorjones
Copy link
Owner

OK, the remaining failure looks like it's because of these additional CSS properties being allowed (the test is probably descriptive and not prescriptive). I'll take a closer look.

@flavorjones
Copy link
Owner

Closing. I really want additions to the allowlist to be driven by real user needs.

For example, I'm not comfortable with position in this list, because untrusted content could then be superimposed on other parts of a web page.

Another example, accent-color which I know as primarily used for styling web forms, which aren't appropriate for Loofah sanitization.

Sorry it took so long to circle back on this and close the loop. I'm open to additions to the allowlist, but I do want to be able to to have a conversation with the users who are asking.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants