Hacker News Reader

If you read the article, you will find that DOMPurify uses a whitelist, that DOMPurify’s model thinks the offending snippet is safe, that nothing in particular is wrong with the model per se, and that the bug is something else entirely.

View on HN

I disagree, dompurify takes a blacklist approach of trying to remove evil instead of only allowing through application-specific sane things (that it uses whitelists is a separate thing)

You need defaults, and that default is an allow-list of sane HTML. If you want, you can initialize DOMPurify with your own allow-list, that might just be the bold, italics, underline, strikethrough.

The fact that their list is not namespace-specific is a bigger issue imo.

Reply on news.ycombinator.com