wikijs-fork/server/modules/rendering/html-security/definition.yml

key: htmlSecurity
title: Security
description: Filter and strips potentially dangerous content
author: requarks.io
icon: mdi-fire
enabledDefault: true
dependsOn: htmlCore
step: post
order: 99999
props:
  safeHTML:
    type: Boolean
    title: Sanitize HTML
    default: true
    hint: Sanitize HTML from unsafe attributes and tags that could lead to XSS attacks
    order: 1
  allowDrawIoUnsafe:
    type: Boolean
    title: Allow Draw.io Unsafe Elements
    default: true
    hint: Draw.io diagrams may introduce some elements that are usually filtered. Turning off this option may cause some diagrams to be completely removed during the sanitization process.
    order: 2
  allowIFrames:
    type: Boolean
    title: Allow iframes
    default: false
    hint: iframes will not be stripped if enabled. (Not recommended)
    order: 3
feat: rendering pipeline logic 2018-09-09 20:33:10 -04:00			`key: htmlSecurity`
			`title: Security`
			`description: Filter and strips potentially dangerous content`
			`author: requarks.io`
fix: admin rendering UI + dark mode 2019-08-04 23:53:21 -04:00			`icon: mdi-fire`
feat: rendering pipeline logic 2018-09-09 20:33:10 -04:00			`enabledDefault: true`
			`dependsOn: htmlCore`
feat: rendering security module 2019-12-11 23:35:54 -05:00			`step: post`
fix: html rendering order param + decodeEntities 2020-01-03 01:07:29 -05:00			`order: 99999`
feat: rendering pipeline logic 2018-09-09 20:33:10 -04:00			`props:`
feat: rendering security module 2019-12-11 23:35:54 -05:00			`safeHTML:`
feat: rendering pipeline logic 2018-09-09 20:33:10 -04:00			`type: Boolean`
feat: rendering security module 2019-12-11 23:35:54 -05:00			`title: Sanitize HTML`
			`default: true`
			`hint: Sanitize HTML from unsafe attributes and tags that could lead to XSS attacks`
fix: escape mustache template chars in content 2020-05-08 17:00:02 -04:00			`order: 1`
fix: draw.io svgs are no longer removed with linebreaks (#2415) 2020-09-12 14:05:24 -04:00			`allowDrawIoUnsafe:`
			`type: Boolean`
			`title: Allow Draw.io Unsafe Elements`
			`default: true`
			`hint: Draw.io diagrams may introduce some elements that are usually filtered. Turning off this option may cause some diagrams to be completely removed during the sanitization process.`
			`order: 2`
fix: escape mustache template chars in content 2020-05-08 17:00:02 -04:00			`allowIFrames:`
			`type: Boolean`
			`title: Allow iframes`
			`default: false`
			`hint: iframes will not be stripped if enabled. (Not recommended)`
fix: draw.io svgs are no longer removed with linebreaks (#2415) 2020-09-12 14:05:24 -04:00			`order: 3`