The sanitizeSchema object defines the allowed HTML tags and attributes used by the server to clean content. It extends the defaultSchema from hast-util-sanitize with specific restrictions to ensure security and content cleanliness.
By default, the following modifications are applied:
- Removed Tags:
img, script, style, header, footer, nav are stripped from the allowed list. - Removed Global Attributes: The attributes
style, onload, and onclick are stripped from all elements (*).
export const sanitizeSchema: SanitizeOptions = {
...defaultSchema,
tagNames: (defaultSchema.tagNames ?? []).filter(
t =>
!['img', 'script', 'style', 'header', 'footer', 'nav'].includes(t),
),
attributes: {
...defaultSchema.attributes,
'*': (defaultSchema.attributes?.['*'] ?? []).filter(
attr => !['style', 'onload', 'onclick'].includes(attr),
),
},
}