From cc93d7eea9bc7ffdfeef0d4de2b4f7f2a06c6caa Mon Sep 17 00:00:00 2001 From: Brooke Kuhlmann Date: Thu, 18 Jun 2026 08:21:02 -0600 Subject: [PATCH] Fixed sanitizer to allow data attribute for all elements The link:https://trmnl.com/framework[TRMNL Framework] makes use of the `data` attribute across multiple elements so this adjusts the configuration so that the `data` attribute can be used on all elements as well. This is done by combining the default attributes with the data attribute via a single configuration for the `all` attributes key. The spec reflects this change because the default Sanitize configuration has no predefined attributes for the `div` element which makes it a good candidate (without any overlapping attributes) to verify this works. Co-authored-by: Stephan Zalewski Milestone: patch --- config/sanitize.yml | 13 +++++++++++-- spec/app/aspects/sanitizer_spec.rb | 8 ++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/config/sanitize.yml b/config/sanitize.yml index 592bdfa8..bb8b1821 100644 --- a/config/sanitize.yml +++ b/config/sanitize.yml @@ -26,6 +26,17 @@ elements: - text - tspan attributes: + :all: + - :data + - class + - dir + - hidden + - id + - lang + - style + - tabindex + - title + - translate canvas: - id - width @@ -43,8 +54,6 @@ attributes: - fill-opacity - shape-rendering - transform - div: - - :data ellipse: - cx - cv diff --git a/spec/app/aspects/sanitizer_spec.rb b/spec/app/aspects/sanitizer_spec.rb index 09766d9c..f23f8792 100644 --- a/spec/app/aspects/sanitizer_spec.rb +++ b/spec/app/aspects/sanitizer_spec.rb @@ -6,6 +6,14 @@ RSpec.describe Terminus::Aspects::Sanitizer do subject(:sanitizer) { described_class.new } describe "#call" do + it "allows specific attributes for all elements" do + source = <<~HTML.squeeze(" ").delete("\n").strip + + HTML + + expect(sanitizer.call(source)).to eq(source) + end + it "allows custom CSS properties" do source = <<~HTML.squeeze(" ").delete("\n").strip