peter/daybook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document that html_full is intentionally not validated

Browse source 
Records the decision to keep html_full fully flexible: no sanitization, no
CSP, and no HTML/CSS validation — malformed markup is kept as-is. The
themed kinds (markdown/html_fragment/deck) remain sanitized, which also
normalizes them to well-formed HTML.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
peter 2026-09-03 10:50:06 +01:00
parent e3c5773e8f
commit 5c53643349
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/api.md
View file

@ -54,7 +54,8 @@ Content-Security-Policy. As a side effect, sanitized output is always
well-formed HTML.
`html_full` is the deliberate exception: it is stored and served **exactly**
as posted, with no sanitization and no restrictive CSP. It is the
as posted — no sanitization, no restrictive CSP, and no HTML/CSS validation
(malformed markup is kept as-is rather than rejected or repaired). It is the
"poster owns all presentation, including any scripts and the security
implications" escape hatch — only post trusted content as `html_full`.