Security (XSS)
What the editor filters, and why your server must filter too.
82editor filters every HTML input (setHTML, paste, drop, source view) through an allow-list. No script or style tags, on* attributes, javascript: URLs or unapproved iframes survive.
Server-side libraries
| Language | Library |
|---|---|
| PHP | HTML Purifier |
| Node | DOMPurify with jsdom, or sanitize-html |
| Java | OWASP Java HTML Sanitizer, jsoup Safelist |
| Python | nh3 |
Match your allow-list to the editor output: p br div span h1-h6 strong em u s sub sup code pre blockquote ul ol li a img figure figcaption table thead tbody tr th td caption colgroup col hr mark nav iframe font, with style, href, src, alt, colspan, rowspan, data-checklist, data-checked, data-video. iframes only from YouTube, Vimeo, Naver TV, Kakao TV and Dailymotion.