Interface Config

src/config.ts:6–232

 * Configuration to control DOMPurify behavior.
 */
export interface Config {
  /**
   * Extend the existing array of allowed attributes.
   * Can be an array of attribute names, or a function that receives
   * the attribute name and tag name to determine if the attribute is allowed.
   */
  ADD_ATTR?:
    | string[]
    | ((attributeName: string, tagName: string) => boolean)
    | undefined;

  /**
   * Extend the existing array of elements that can use Data URIs.
   */
  ADD_DATA_URI_TAGS?: string[] | undefined;

  /**
   * Extend the existing array of allowed tags.
   * Can be an array of tag names, or a function that receives
   * the tag name to determine if the tag is allowed.
   */
  ADD_TAGS?: string[] | ((tagName: string) => boolean) | undefined;

  /**
   * Extend the existing array of elements that are safe for URI-like values (be careful, XSS risk).
   */
  ADD_URI_SAFE_ATTR?: string[] | undefined;

  /**
   * Allow ARIA attributes, leave other safe HTML as is (default is true).
   */
  ALLOW_ARIA_ATTR?: boolean | undefined;

  /**
   * Allow HTML5 data attributes, leave other safe HTML as is (default is true).
   */
  ALLOW_DATA_ATTR?: boolean | undefined;

  /**
   * Allow external protocol handlers in URL attributes (default is false, be careful, XSS risk).
   * By default only `http`, `https`, `ftp`, `ftps`, `tel`, `mailto`, `callto`, `sms`, `cid` and `xmpp` are allowed.
   */
  ALLOW_UNKNOWN_PROTOCOLS?: boolean | undefined;

  /**
   * Decide if self-closing tags in attributes are allowed.
   * Usually removed due to a mXSS issue in jQuery 3.0.
   */
  ALLOW_SELF_CLOSE_IN_ATTR?: boolean | undefined;

  /**
   * Allow only specific attributes.
   */
  ALLOWED_ATTR?: string[] | undefined;

  /**
   * Allow only specific elements.
   */