If you are generating, you should have a whitelist of safe html/css..
Apart from performance this smells of not using a whitelist mechanism (I hope this is not the case).
Apart from performance this smells of not using a whitelist mechanism (I hope this is not the case).
What makes you think that? I just skimmed the draft and it seems to use a sensible whitelist as default. Developers can allow or deny additional elements/attributes as they like.