Skip to content

Remove HTML sanitizer #3956

@iamareebjamal

Description

@iamareebjamal

https://github.com/apostrophecms/sanitize-html#browser

It is meant to be used in node servers. Not browsers. It takes up a huge chunk of bundle as well.

As written in the repo, think, why do you need to sanitize HTML on client? That is the job of server. Besides I believe, we shouldn't even be storing HTML in backend. It should store markup like markdown, not DOM (#2493). Most people are not using our rich descriptions feature and it is needlessly storing <p> tags in DB without any reason

Trigger Reason: We need to allow polyfills of node dependencies like path in order to include it in the build - embroider-build/ember-auto-import#224 (comment)
As ember-auto-import now correctly removes node builtins being polyfilled

Edit:
HTML-sanitizer has been relaced with dompurify

180 KB -> 16 KB

We still have to remove sanitization from frontend, its role of the backend

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions