Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Right now, by default, Sanitize page is turned on and will remove such tags as <fieldset> and <legend> which are used by Drupal 7 for jQuery collapsible areas on the page.
Also, all <svg> is blocked, even though any Javascript it contained would have been stripped out anyway.
It would be good to allow the following tags: 'audio', 'canvas', 'embed', 'fieldset', 'legend', 'path', 'rect', 'source', 'svg', 'track','video'.
The 'object' tag should not be allowed added because of the <object data="javascript:..."> attack.
Comments
Comment #3
andrewfn commentedUnfortunately filter_xss_admin() cannot be used because the code is somewhat old and does not allow HTML 5 tags. Until Drupal catches up, a copy of the function has been included but with the HTML 5 tags added.