Fixed sanitizer to allow data attribute for all elements

The link:https://trmnl.com/framework[TRMNL Framework] makes use of the `data` attribute across multiple elements so this adjusts the configuration so that the `data` attribute can be used on all elements as well. This is done by combining the default attributes with the data attribute via a single configuration for the `all` attributes key. The spec reflects this change because the default Sanitize configuration has no predefined attributes for the `div` element which makes it a good candidate (without any overlapping attributes) to verify this works. Co-authored-by: Stephan Zalewski <stephan@stzal.com> Milestone: patch
2026-08-13 14:29:27 -07:00 · 2026-06-18 08:46:46 -06:00
parent e27a602f6f
commit cc93d7eea9
2 changed files with 19 additions and 2 deletions
@@ -26,6 +26,17 @@ elements:
  - text
  - tspan
 attributes:
+  :all:
+    - :data
+    - class
+    - dir
+    - hidden
+    - id
+    - lang
+    - style
+    - tabindex
+    - title
+    - translate
  canvas:
    - id
    - width
@@ -43,8 +54,6 @@ attributes:
    - fill-opacity
    - shape-rendering
    - transform
-  div:
-    - :data
  ellipse:
    - cx
    - cv
@@ -6,6 +6,14 @@ RSpec.describe Terminus::Aspects::Sanitizer do
  subject(:sanitizer) { described_class.new }

  describe "#call" do
+    it "allows specific attributes for all elements" do
+      source = <<~HTML.squeeze(" ").delete("\n").strip
+        <html><head></head> <body> <div data-role="primary" class="test" dir="ltr" hidden="" id="en" style="color: red;" tabindex="0" title="Test" translate="yes">test</div></body></html>
+      HTML
+
+      expect(sanitizer.call(source)).to eq(source)
+    end
+
    it "allows custom CSS properties" do
      source = <<~HTML.squeeze(" ").delete("\n").strip
        <html><head> <style type="text/css"> .screen { --screen-w: 1040px; --screen-h: 780px; --pixel-ratio: 1.8; --dither-pixel-ratio: 2.0; --ui-scale: 1.0; --gap-scale: 1.0; } </style> </head> <body></body></html>