-
-
Notifications
You must be signed in to change notification settings - Fork 831
Support strict XHTML documents #567
Description
This issue proposes a feature which adds support for sanitization of strict XHTML documents.
Background & Context
I would like to use DOMPurify to sanitize strict XHTML documents. In contrary to HTML, tag and attribute names in XHTML documents are case-sensitive. This is somehow related to #144 or #476. I believe current version of DOMPurify treats all input as HTML (tag and attribute names are NOT case-sensitive and converted to lowercase).
Say XHTML document is served with Content-Type application/xhtml+xml` and contains tag. Current browsers (I tested with latest Chrome) will ignore such element because tags must be lowercase in XHTML. If we sanitize such document through DOMPurify before serving it to the browser - will get converted to and browser renders it as a link. I would instead expect DOMPurify to keep only valid (lowercase) tags and therefore remove .
Feature
We are proposing an implementation that adds new option - PARSER_MEDIA_TYPE which can be:
- text/html (default, current behavior)
- application/xhtml+xml (new behavior, DOMPurify parses input as strict XHTML and tag and attribute names are case-sensitive)