Firefox Tomorrow

guide

Default sanitizer configuration

View on MDN ↗

The default sanitizer configuration defines the configuration returned by the Sanitizer() constructor if no configuration is passed as an argument. This same configuration is implicitly used if you call the safe sanitization methods, such as setHTML(), setHTML(), and Document.parseHTML(), without specifying a custom sanitizer.

This configuration removes the following sorts of items:

  1. Those that are known to be XSS-unsafe:
  2. Items that might be used in clickjacking, spoofing, or other attacks.
  3. Deprecated items.
  4. Comments and data-* attributes.

It therefore provides a sanitizer with a minimal attack surface, which is still suitable for the majority of sanitization use cases.

[!NOTE] Calling removeUnsafe(), or passing a custom sanitizer to the safe sanitization method, only removes the XSS-unsafe items. It does not remove the additional items, comments, and data-* attributes.

The following sections list all the elements, with a ✓ mark indicating those that are allowed by the default configuration (the ❌ therefore indicates those that will be removed). The “Additional allowed attributes” column lists the attributes that are allowed for the corresponding elements; any other attributes on the element would be removed (unless allowed by the global attributes). The Global attributes section lists the attributes that are allowed on all elements (the attributes that are not removed when the configuration is used).

HTML elements

ElementAllowedAdditional allowed attributes
<a>✓href, hreflang, type
<abbr>✓
<acronym>❌
<address>✓
<area>❌
<article>✓
<aside>✓
<audio>❌
<b>✓
<base>❌
<bdi>✓
<bdo>✓
<big>❌
<blockquote>✓cite
<body>✓
<br>✓
<button>❌
<canvas>❌
<caption>✓
<center>❌
<cite>✓
<code>✓
<col>✓span
<colgroup>✓span
<data>✓value
<datalist>❌
<dd>✓
<del>✓cite, datetime
<details>❌
<dfn>✓
<dialog>❌
<dir>❌
<div>✓
<dl>✓
<dt>✓
<em>✓
<embed>❌
<fencedframe>❌
<fieldset>❌
<figcaption>✓
<figure>✓
<font>❌
<footer>✓
<form>❌
<frame>❌
<frameset>❌
<&lt;h1&gt; – &lt;h6&gt;>✓
<head>✓
<header>✓
<hgroup>✓
<hr>✓
<html>✓
<i>✓
<iframe>❌
<img>❌
<input>❌
<ins>✓cite, datetime
<kbd>✓
<label>❌
<legend>❌
<li>✓value
<link>❌
<main>✓
<map>❌
<mark>✓
<marquee>❌
<menu>✓
<meta>❌
<meter>❌
<nav>✓
<nobr>❌
<noembed>❌
<noframes>❌
<noscript>❌
<object>❌
<ol>✓reversed, start, type
<optgroup>❌
<option>❌
<output>❌
<p>✓
<param>❌
<picture>❌
<plaintext>❌
<pre>✓
<progress>❌
<q>✓
<rb>❌
<rp>✓
<rt>✓
<rtc>❌
<ruby>✓
<s>✓
<samp>✓
<script>❌
<search>✓
<section>✓
<select>❌
<selectedcontent>❌
<slot>❌
<small>✓
<source>❌
<span>✓
<strike>❌
<strong>✓
<style>❌
<sub>✓
<summary>❌
<sup>✓
<table>✓
<tbody>✓
<td>✓colspan, headers, rowspan
<template>❌
<textarea>❌
<tfoot>✓
<th>✓abbr, colspan, headers, rowspan, scope
<thead>✓
<time>✓datetime
<title>✓
<tr>✓
<track>❌
<tt>❌
<u>✓
<ul>✓
<var>✓
<video>❌
<wbr>✓
<xmp>❌

SVG elements

ElementAllowedAdditional allowed attributes
<a>✓href, hreflang, type
<animate>❌
<animateMotion>❌
<animateTransform>❌
<circle>✓cx, cy, pathLength, r
<clipPath>❌
<defs>✓
<desc>✓
<ellipse>✓cx, cy, pathLength, rx, ry
<feBlend>❌
<feColorMatrix>❌
<feComponentTransfer>❌
<feComposite>❌
<feConvolveMatrix>❌
<feDiffuseLighting>❌
<feDisplacementMap>❌
<feDistantLight>❌
<feDropShadow>❌
<feFlood>❌
<feFuncA>❌
<feFuncB>❌
<feFuncG>❌
<feFuncR>❌
<feGaussianBlur>❌
<feImage>❌
<feMerge>❌
<feMergeNode>❌
<feMorphology>❌
<feOffset>❌
<fePointLight>❌
<feSpecularLighting>❌
<feSpotLight>❌
<feTile>❌
<feTurbulence>❌
<filter>❌
<foreignObject>✓height, width, x, y
<g>✓
<image>❌
<line>✓pathLength, x1, x2, y1, y2
<linearGradient>❌
<marker>✓markerHeight, markerUnits, markerWidth, orient, preserveAspectRatio, refX, refY, viewBox
<mask>❌
<metadata>✓
<mpath>❌
<path>✓d, pathLength
<pattern>❌
<polygon>✓pathLength, points
<polyline>✓pathLength, points
<radialGradient>❌
<rect>✓height, pathLength, rx, ry, width, x, y
<script>❌
<set>❌
<stop>❌
<style>❌
<svg>✓height, preserveAspectRatio, viewBox, width, x, y
<switch>❌
<symbol>❌
<text>✓dx, dy, lengthAdjust, rotate, textLength, x, y
<textPath>✓lengthAdjust, method, path, side, spacing, startOffset, textLength
<title>✓
<tspan>✓dx, dy, lengthAdjust, rotate, textLength, x, y
<use>❌
<view>❌

MathML elements

ElementAllowedAdditional allowed attributes
annotation❌
annotation-xml❌
maction❌
math✓
menclose❌
merror✓
mfenced❌
mfrac✓
mi✓
mmultiscripts✓
mn✓
mo✓fence, form, largeop, lspace, maxsize, minsize, movablelimits, rspace, separator, stretchy, symmetric
mover✓accent
mpadded✓depth, height, lspace, voffset, width
mphantom✓
mprescripts✓
mroot✓
mrow✓
ms✓
mspace✓depth, height, width
msqrt✓
mstyle✓
msub✓
msubsup✓
msup✓
mtable✓
mtd✓columnspan, rowspan
mtext✓
mtr✓
munder✓accentunder
munderover✓accent, accentunder
semantics✓

Global attributes

The default configuration allows the following attributes on all elements.

HTML global attributes

MathML global attributes

SVG attributes

  • alignment-baseline
  • baseline-shift
  • clip-path
  • clip-rule
  • color
  • color-interpolation
  • cursor
  • direction
  • display
  • dominant-baseline
  • fill
  • fill-opacity
  • fill-rule
  • font-family
  • font-size
  • font-size-adjust
  • font-stretch
  • font-style
  • font-variant
  • font-weight
  • letter-spacing
  • marker-end
  • marker-mid
  • marker-start
  • opacity
  • paint-order
  • pointer-events
  • shape-rendering
  • stop-color
  • stop-opacity
  • stroke
  • stroke-dasharray
  • stroke-dashoffset
  • stroke-linecap
  • stroke-linejoin
  • stroke-miterlimit
  • stroke-opacity
  • stroke-width
  • text-anchor
  • text-decoration
  • text-overflow
  • text-rendering
  • transform
  • transform-origin
  • unicode-bidi
  • vector-effect
  • visibility
  • white-space
  • word-spacing
  • writing-mode