Skip to content

Commit

Permalink
clarifications thanks to @annevk, @bkardell and @otherdanial
Browse files Browse the repository at this point in the history
  • Loading branch information
polx committed Jan 16, 2025
1 parent dcdade6 commit 1eb208e
Showing 1 changed file with 7 additions and 6 deletions.
13 changes: 7 additions & 6 deletions mathml-safe-list.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,10 @@
MathML-core considers all elements and attributes of MathML-core (as listed in [section 2.1 of MathML-core](https://w3c.github.io/mathml-core/#mathml-elements-and-attributes)) as safe and not needing a sanitziation except the following elements.

We recommend the [Sanitzer API](https://wicg.github.io/sanitizer-api/) to sanitize MathML by keeping all elements and attributes except the follwing:
- any common attribute with HTML attributes which need a sanitzation,
- the `maction` and `mphantom` elements (the element can be replaced by their first child), and
- any `annotation` or `annotation-xml` element whose `encoding` attribute is of a media-type that is is either absent or is not among the trusted types or if it contains an `href` attribute.
- any common attribute with HTML attributes for which need a sanitzation as done in HTML,
- the `mphantom` element which should be removed,
- the `maction` elements which should, ideally, be replaced by its first child element, and
- any `annotation` or `annotation-xml` element whose `encoding` attribute is of a media-type that is is either absent or is not among the trusted types or if it contains an `href` attribute, which should be removed.

### Detailed Version
MathML-core considers the following elements and attributes of MathML-core as safe and not needing sanitization:
Expand All @@ -20,7 +21,7 @@ Attributes of MathML-core:
Moreover, the following attributes have their syntax and semantics specified in the HTML specification. The sanitizer behaviour on these attributes should be as is done on HTML elements: `on*, id, class, style, data-*, autofocus, nonce,tabindex` (for example any javascript should be removed).

The elements of MathML-core which need treatment by the sanitizers are the following:
- `annotation` and `annotation-xml` if their `encoding` attribute is not considered of a safe type (e.g. if the encoding is `text/plain` then it could be kept). If removed, the element should be replaced by its first child.
- `maction` is replaced by their first child
- `mphantom` is removed
- `annotation` and `annotation-xml` if their `encoding` attribute is not considered of a safe type (e.g. if the encoding is `text/plain` then it could be kept). Sanitization should remove these elements.
- `maction` should be replaced by its first child element.
- `mphantom` should be removed.

0 comments on commit 1eb208e

Please sign in to comment.