The Sanitizer API's default configuration defines which HTML, SVG, and MathML elements and attributes are kept when sanitizing content. Comments and data-* attributes are removed by default.
The following attributes are allowed on all elements in the default configuration:
alignment-baselinebaseline-shift
| Description | Example | Can have integrity metadata [^1] | Content-Security-Policy support for hashes | Integrity-Policy support [^2] |
|---|---|---|---|---|
| External script | <script src=http://> |
Yes (integrity attribute) |
Yes | Yes |
| Inline script | <script>alert("hello world");</script> |
No [^3] | Yes | No |
| Event handlers | onclick=alert(1) |
No | Yes (with 'unsafe-hashes') |
No |
| javascript: protocol | javascript:alert(2) |
No | Yes (with 'unsafe-hashes') |
No |
| Static import | import foo from "/bar.js" |
Yes ("importmap") |
Yes | Yes |
| Dynamic import | import("/script.js") |
Yes ("importmap") |
Yes | Yes |
| Eval | eval("alert('boo');")new Function() ... |
No | No [^4] | No |
| WebAssembly | No |
| <!DOCTYPE html> | |
| <html> | |
| <head> | |
| <meta charset="utf-8"> | |
| <meta name="viewport" content="width=device-width, initial-scale=1"> | |
| <title></title> | |
| </head> | |
| <body> | |
| <div> |
| <!doctype html> | |
| <html> | |
| <body> | |
| <script> | |
| var abortController = new AbortController(); | |
| let i = 0; | |
| let aborted = false; | |
| var rs = new ReadableStream({ |
| ┌──────────────┐ ┌──────────────┐ | |
| │Closed promise├───┐ ┌──────────┤Closed promise│ | |
| └──┬───────────┘ │ │ └──────────────┘ | |
| │ NativePromiseHandler ▲ | |
| │ │ │ │ | |
| │ ▼ ▼ │ | |
| ┌────┴──┐ ┌────────────┐ ┌────┴─┐ | |
| │ Writer│◄────────┤ PipeToPump │ ───────►│Reader│ | |
| └───────┘ └────────────┘ └─┬────┘ | |
| ▲ │ |
| diff --git a/dom/events/test/test_DataTransferItemList.html b/dom/events/test/test_DataTransferItemList.html | |
| --- a/dom/events/test/test_DataTransferItemList.html | |
| +++ b/dom/events/test/test_DataTransferItemList.html | |
| @@ -30,6 +30,7 @@ | |
| var dragstartFired = 0; | |
| draggable.addEventListener('dragstart', onDragStart); | |
| function onDragStart(e) { | |
| + console.log("dragstart"); | |
| draggable.removeEventListener('dragstart', onDragStart); | |
| alias: Keypad Arm | |
| description: Arm Home Assistant alarm using the keypad. | |
| trigger: | |
| - platform: mqtt | |
| topic: zigbee2mqtt/Keypad | |
| condition: | |
| - condition: template | |
| value_template: '{{ trigger.payload_json.action_code == "9998" }}' | |
| - condition: template | |
| value_template: '{{ trigger.payload_json.action == "arm_all_zones" }}' |
| var stream = new ReadableStream({ | |
| start(controller) { | |
| controller.enqueue("abc"); | |
| controller.enqueue("123"); | |
| controller.close() | |
| } | |
| }); | |
| var reader = stream.getReader(); | |
| reader.read().then(({ value, done}) => { |
| #!/usr/bin/python | |
| # -*- coding: utf-8 -*- | |
| import argparse | |
| import glob | |
| import os | |
| parser = argparse.ArgumentParser(description='Run kraken/sunspider.', | |
| formatter_class=argparse.ArgumentDefaultsHelpFormatter) | |
| parser.add_argument( | |
| '--shell', |