diff --git a/.github/workflows/pr-push.yml b/.github/workflows/pr-push.yml index a647524..8aa097d 100644 --- a/.github/workflows/pr-push.yml +++ b/.github/workflows/pr-push.yml @@ -9,6 +9,13 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + - uses: actions/setup-python@v4 + with: + python-version: '3.10' + - name: Generate safe-default-configuration.json + run: python builtins/safe-default-configuration.py --input builtins/safe-default-configuration.txt --out builtins/safe-default-configuration.json + - name: Generate safe-baseline-configuration-materialized.json + run: python builtins/safe-baseline-configuration.py --input builtins/safe-baseline-configuration.json --event-handlers builtins/event-handler-content-attributes.txt --out builtins/safe-baseline-configuration-materialized.json - uses: w3c/spec-prod@v2 with: GH_PAGES_BRANCH: gh-pages diff --git a/.gitignore b/.gitignore index 5a11222..c46a6e3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ /.project /out /*.ninja* +/builtins/safe-default-configuration.json +/builtins/safe-baseline-configuration-materialized.json diff --git a/builtins/event-handler-content-attributes.txt b/builtins/event-handler-content-attributes.txt new file mode 100644 index 0000000..af71ef7 --- /dev/null +++ b/builtins/event-handler-content-attributes.txt @@ -0,0 +1,89 @@ +// https://html.spec.whatwg.org/#ix-event-handlers +onafterprint +onauxclick +onbeforeinput +onbeforematch +onbeforeprint +onbeforeunload +onbeforetoggle +onblur +oncancel +oncanplay +oncanplaythrough +onchange +onclick +onclose +oncontextlost +oncontextmenu +oncontextrestored +oncopy +oncuechange +oncut +ondblclick +ondrag +ondragend +ondragenter +ondragleave +ondragover +ondragstart +ondrop +ondurationchange +onemptied +onended +onerror +onfocus +onformdata +onhashchange +oninput +oninvalid +onkeydown +onkeypress +onkeyup +onlanguagechange +onload +onloadeddata +onloadedmetadata +onloadstart +onmessage +onmessageerror +onmousedown +onmouseenter +onmouseleave +onmousemove +onmouseout +onmouseover +onmouseup +onoffline +ononline +onpagehide +onpagereveal +onpageshow +onpageswap +onpaste +onpause +onplay +onplaying +onpopstate +onprogress +onratechange +onreset +onresize +onrejectionhandled +onscroll +onscrollend +onsecuritypolicyviolation +onseeked +onseeking +onselect +onslotchange +onstalled +onstorage +onsubmit +onsuspend +ontimeupdate +ontoggle +onunhandledrejection +onunload +onvolumechange +onwaiting +onwheel diff --git a/builtins/safe-baseline-configuration-materialized.json b/builtins/safe-baseline-configuration-materialized.json new file mode 100644 index 0000000..e69de29 diff --git a/builtins/safe-baseline-configuration.json b/builtins/safe-baseline-configuration.json new file mode 100644 index 0000000..2f6c8c1 --- /dev/null +++ b/builtins/safe-baseline-configuration.json @@ -0,0 +1,33 @@ +{ + "removeElements": [ + { + "namespace": "http://www.w3.org/1999/xhtml", + "name": "script" + }, + { + "namespace": "http://www.w3.org/1999/xhtml", + "name": "frame" + }, + { + "namespace": "http://www.w3.org/1999/xhtml", + "name": "iframe" + }, + { + "namespace": "http://www.w3.org/1999/xhtml", + "name": "object" + }, + { + "namespace": "http://www.w3.org/1999/xhtml", + "name": "embed" + }, + { + "namespace": "http://www.w3.org/2000/svg", + "name": "script" + }, + { + "namespace": "http://www.w3.org/2000/svg", + "name": "use" + } + ], + "removeAttributes": [] +} diff --git a/builtins/safe-baseline-configuration.py b/builtins/safe-baseline-configuration.py new file mode 100644 index 0000000..452ecc4 --- /dev/null +++ b/builtins/safe-baseline-configuration.py @@ -0,0 +1,39 @@ +# Sanitizer API - Build configuration dictionary from text file. + +import json +import argparse +import sys + +def main(): + parser = argparse.ArgumentParser() + parser.add_argument("--input", type=argparse.FileType('r'), required=True) + parser.add_argument("--event-handlers", type=argparse.FileType('r'), + required=True) + parser.add_argument("--out", type=argparse.FileType('w'), required=True) + args = parser.parse_args() + + try: + config = json.load(args.input) + except BaseException as err: + parser.error("Cannot read from --input file.") + + try: + events = args.event_handlers.read() + except BaseException as err: + parser.error("Cannot read from --event-handlers file.") + + for event in events.split("\n"): + if not event: + continue + if event.startswith("//"): + continue + config["removeAttributes"].append(event) + + try: + json.dump(config, args.out, indent=2) + except BaseException as err: + parser.error("Cannot write to --out file.") + return 0 + +if __name__ == "__main__": + main() diff --git a/builtins/safe-default-configuration.json b/builtins/safe-default-configuration.json new file mode 100644 index 0000000..e69de29 diff --git a/builtins/safe-default-configuration.py b/builtins/safe-default-configuration.py new file mode 100644 index 0000000..61996fd --- /dev/null +++ b/builtins/safe-default-configuration.py @@ -0,0 +1,42 @@ +# Sanitizer API - Build configuration dictionary from text file. + +import json +import argparse +import sys + +def main(): + parser = argparse.ArgumentParser() + parser.add_argument("--input", type=argparse.FileType('r'), required=True) + parser.add_argument("--out", type=argparse.FileType('w'), required=True) + args = parser.parse_args() + + try: + lines = args.input.read() + except BaseException as err: + parser.error("Cannot read from --input file.") + + result = { "elements": [], "attributes": [] } + current = [] + for line in lines.split("\n"): + if not line: + pass + elif line.startswith("//"): + pass + elif line.startswith("- "): + current.append({ "name": line[2:], "namespace": None }) + elif line == "[HTML Global]": + current = result["attributes"] + else: + elem = { "name": line, "namespace": "http://www.w3.org/1999/xhtml", + "attributes": [] } + result["elements"].append(elem) + current = elem["attributes"] + + try: + json.dump(result, args.out, indent=2) + except BaseException as err: + parser.error("Cannot write to --out file.") + return 0 + +if __name__ == "__main__": + main() diff --git a/builtins/safe-default-configuration.txt b/builtins/safe-default-configuration.txt new file mode 100644 index 0000000..7c8850b --- /dev/null +++ b/builtins/safe-default-configuration.txt @@ -0,0 +1,171 @@ +// Document element +// https://html.spec.whatwg.org/#the-root-element + +html + +// Document metadata +// https://html.spec.whatwg.org/#document-metadata + +head +title + +// meta and link, purposely omitted + +// Sections +// https://html.spec.whatwg.org/#sections + +body +article +section +nav +aside +h1 +h2 +h3 +h4 +h5 +h6 +hgroup +header +footer +address + +// Grouping Content +// https://html.spec.whatwg.org/#grouping-content + +p +hr +pre +blockquote +- cite +ol +- reversed +- start +- type +ul +menu +li +- value +dl +dt +dd +figure +figcaption +main +search +div + +// Text-level Semantics +// https://html.spec.whatwg.org/#text-level-semantics ### + +a +- href +- rel +- hreflang +- type +// Purposely omitted: +// - target +// - download +// - referrerpolicy +// - ping +em +strong +small +s +cite +q +dfn +- title +abbr +- title +ruby +rt +rp +data +- value +time +- datetime +code +var +samp +kbd +sub +sup +i +b +u +mark +bdi +- dir +bdo +- dir +span +br +wbr + +// Edits +// https://html.spec.whatwg.org/#edits + +ins +- cite +- datetime +del +- cite +- datetime + +// Embedded content +// https://html.spec.whatwg.org/#embedded-content +// +// Purposely omitted. + +// Tabular Data +// https://html.spec.whatwg.org/#tables + +table +caption +colgroup +- span +col +- span +tbody +thead +tfoot +tr +td +- colspan +- rowspan +- headers +th +- colspan +- rowspan +- headers +- scope +- abbr + +// Forms +// https://html.spec.whatwg.org/#forms +// +// Purposely omitted + +// Interactive Elements +// https://html.spec.whatwg.org/#interactive-elements +// +// Purposly omitted. + +// Scripting +// https://html.spec.whatwg.org/#scripting +// +// Purposely omitted. + +// SVG: TBD +// MathML: TDB + +// HTML global attributes +// +// Selection of attributes. Most are purposely omitted. + +[HTML Global] +- dir +- lang +- title + diff --git a/index.bs b/index.bs index e758d55..ca31e34 100644 --- a/index.bs +++ b/index.bs @@ -22,6 +22,7 @@ Markup Shorthands: css off, markdown on spec:html; type:attribute; text: innerHTML spec:dom; type:method; text: createDocumentFragment spec:html; type:dfn; text: template contents +spec:infra; type:dfn; text: user agent
text: window.toStaticHTML(); type: method; url: https://msdn.microsoft.com/en-us/library/cc848922(v=vs.85).aspx @@ -576,6 +577,8 @@ To remove unsafe from a |configuration|, do thi 1. [=list/For each=] |attribute| in [=built-in safe baseline configuration=][{{SanitizerConfig/removeAttributes}}]: 1. Call [=Sanitizer/remove an attribute=] with |attribute| and |result|. +1. [=list/For each=] |attribute| listed in [=event handler content attributes=]: + 1. Call [=Sanitizer/remove an attribute=] with |attribute| and |result|. 1. Return |result|. @@ -709,7 +712,7 @@ regard to order: [=superset=] of |B| and |B| is a [=superset=] of |A|. -## Defaults ## {#sanitization-defaults} +## Builtins ## {#sanitization-defaults} There are three builtins: @@ -718,24 +721,37 @@ There are three builtins: * the [=built-in navigating URL attributes list=]. The built-in safe default configuration is as follows: -``` -{ - elements: [ ... ], - attributes: [ ... ], -} -``` + ++path: builtins/safe-default-configuration.json +highlight: json +The built-in safe baseline configuration is meant to block only -script-content, and nothing else. It is as follows: -``` -{ - removeElements: [ - { name: "script", namespace: "http://www.w3.org/1999/xhtml" }, - { name: "script", namespace: "http://www.w3.org/2000/svg" } - ], - removeAttributes: [....], -} -``` +script-content. It is as follows: + ++path: builtins/safe-baseline-configuration.json +highlight: json ++ ++ + +Warning: The [=remove unsafe=] algorithm specifies +to additionally remove any [=event handler content attributes=], as defined +in [[HTML]]. +If a [=user agent=] defines extensions to the [[HTML]] spec with additional +[=event handler content attributes=], it is its responsibility to decide how +to handle them. Using the current [=event handler content attributes=] list, +the safe baseline configuration looks effectively like so: + ++path: builtins/safe-baseline-configuration-materialized.json +highlight: json ++ +The built-in navigating URL attributes list, for which "`javascript:`" diff --git a/resources/baseline-attribute-allow-list.json b/resources/baseline-attribute-allow-list.json deleted file mode 100644 index 1b7bee6..0000000 --- a/resources/baseline-attribute-allow-list.json +++ /dev/null @@ -1,213 +0,0 @@ -[ - "abbr", - "accept", - "accept-charset", - "accesskey", - "action", - "align", - "alink", - "allow", - "allowfullscreen", - "allowpaymentrequest", - "alt", - "anchor", - "archive", - "as", - "async", - "autocapitalize", - "autocomplete", - "autocorrect", - "autofocus", - "autopictureinpicture", - "autoplay", - "axis", - "background", - "behavior", - "bgcolor", - "border", - "bordercolor", - "capture", - "cellpadding", - "cellspacing", - "challenge", - "char", - "charoff", - "charset", - "checked", - "cite", - "class", - "classid", - "clear", - "code", - "codebase", - "codetype", - "color", - "cols", - "colspan", - "compact", - "content", - "contenteditable", - "controls", - "controlslist", - "conversiondestination", - "coords", - "crossorigin", - "csp", - "data", - "datetime", - "declare", - "decoding", - "default", - "defer", - "dir", - "direction", - "dirname", - "disabled", - "disablepictureinpicture", - "disableremoteplayback", - "disallowdocumentaccess", - "download", - "draggable", - "elementtiming", - "enctype", - "end", - "enterkeyhint", - "event", - "exportparts", - "face", - "for", - "form", - "formaction", - "formenctype", - "formmethod", - "formnovalidate", - "formtarget", - "frame", - "frameborder", - "headers", - "height", - "hidden", - "high", - "href", - "hreflang", - "hreftranslate", - "hspace", - "http-equiv", - "id", - "imagesizes", - "imagesrcset", - "importance", - "impressiondata", - "impressionexpiry", - "incremental", - "inert", - "inputmode", - "integrity", - "invisible", - "is", - "ismap", - "keytype", - "kind", - "label", - "lang", - "language", - "latencyhint", - "leftmargin", - "link", - "list", - "loading", - "longdesc", - "loop", - "low", - "lowsrc", - "manifest", - "marginheight", - "marginwidth", - "max", - "maxlength", - "mayscript", - "media", - "method", - "min", - "minlength", - "multiple", - "muted", - "name", - "nohref", - "nomodule", - "nonce", - "noresize", - "noshade", - "novalidate", - "nowrap", - "object", - "open", - "optimum", - "part", - "pattern", - "ping", - "placeholder", - "playsinline", - "policy", - "poster", - "preload", - "pseudo", - "readonly", - "referrerpolicy", - "rel", - "reportingorigin", - "required", - "resources", - "rev", - "reversed", - "role", - "rows", - "rowspan", - "rules", - "sandbox", - "scheme", - "scope", - "scopes", - "scrollamount", - "scrolldelay", - "scrolling", - "select", - "selected", - "shadowroot", - "shadowrootdelegatesfocus", - "shape", - "size", - "sizes", - "slot", - "span", - "spellcheck", - "src", - "srcdoc", - "srclang", - "srcset", - "standby", - "start", - "step", - "style", - "summary", - "tabindex", - "target", - "text", - "title", - "topmargin", - "translate", - "truespeed", - "trusttoken", - "type", - "usemap", - "valign", - "value", - "valuetype", - "version", - "virtualkeyboardpolicy", - "vlink", - "vspace", - "webkitdirectory", - "width", - "wrap" -] diff --git a/resources/baseline-element-allow-list.json b/resources/baseline-element-allow-list.json deleted file mode 100644 index cf470cd..0000000 --- a/resources/baseline-element-allow-list.json +++ /dev/null @@ -1,130 +0,0 @@ -[ - "a", - "abbr", - "acronym", - "address", - "area", - "article", - "aside", - "audio", - "b", - "basefont", - "bdi", - "bdo", - "bgsound", - "big", - "blockquote", - "body", - "br", - "button", - "canvas", - "caption", - "center", - "cite", - "code", - "col", - "colgroup", - "command", - "data", - "datalist", - "dd", - "del", - "details", - "dfn", - "dialog", - "dir", - "div", - "dl", - "dt", - "em", - "fieldset", - "figcaption", - "figure", - "font", - "footer", - "form", - "h1", - "h2", - "h3", - "h4", - "h5", - "h6", - "head", - "header", - "hgroup", - "hr", - "html", - "i", - "image", - "img", - "input", - "ins", - "kbd", - "keygen", - "label", - "layer", - "legend", - "li", - "link", - "listing", - "main", - "map", - "mark", - "marquee", - "menu", - "meta", - "meter", - "nav", - "nobr", - "ol", - "optgroup", - "option", - "output", - "p", - "picture", - "plaintext", - "popup", - "portal", - "pre", - "progress", - "q", - "rb", - "rp", - "rt", - "rtc", - "ruby", - "s", - "samp", - "section", - "select", - "selectmenu", - "slot", - "small", - "source", - "span", - "strike", - "strong", - "style", - "sub", - "summary", - "sup", - "table", - "tbody", - "td", - "template", - "textarea", - "tfoot", - "th", - "thead", - "time", - "title", - "tr", - "track", - "tt", - "u", - "ul", - "var", - "video", - "wbr", - "xmp" -] diff --git a/resources/default-configuration.json b/resources/default-configuration.json deleted file mode 100644 index f6613ae..0000000 --- a/resources/default-configuration.json +++ /dev/null @@ -1,755 +0,0 @@ -{ - "allowCustomElements": false, - "allowUnknownMarkup": false, - "allowElements": [ - "a", - "abbr", - "acronym", - "address", - "area", - "article", - "aside", - "audio", - "b", - "bdi", - "bdo", - "bgsound", - "big", - "blockquote", - "body", - "br", - "button", - "canvas", - "caption", - "center", - "cite", - "code", - "col", - "colgroup", - "datalist", - "dd", - "del", - "details", - "dfn", - "dialog", - "dir", - "div", - "dl", - "dt", - "em", - "fieldset", - "figcaption", - "figure", - "font", - "footer", - "form", - "h1", - "h2", - "h3", - "h4", - "h5", - "h6", - "head", - "header", - "hgroup", - "hr", - "html", - "i", - "img", - "input", - "ins", - "kbd", - "keygen", - "label", - "layer", - "legend", - "li", - "link", - "listing", - "main", - "map", - "mark", - "marquee", - "menu", - "meta", - "meter", - "nav", - "nobr", - "ol", - "optgroup", - "option", - "output", - "p", - "picture", - "popup", - "pre", - "progress", - "q", - "rb", - "rp", - "rt", - "rtc", - "ruby", - "s", - "samp", - "section", - "select", - "selectmenu", - "small", - "source", - "span", - "strike", - "strong", - "style", - "sub", - "summary", - "sup", - "table", - "tbody", - "td", - "tfoot", - "th", - "thead", - "time", - "tr", - "track", - "tt", - "u", - "ul", - "var", - "video", - "wbr" - ], - "allowAttributes": { - "abbr": [ - "*" - ], - "accept": [ - "*" - ], - "accept-charset": [ - "*" - ], - "accesskey": [ - "*" - ], - "action": [ - "*" - ], - "align": [ - "*" - ], - "alink": [ - "*" - ], - "allow": [ - "*" - ], - "allowfullscreen": [ - "*" - ], - "alt": [ - "*" - ], - "anchor": [ - "*" - ], - "archive": [ - "*" - ], - "as": [ - "*" - ], - "async": [ - "*" - ], - "autocapitalize": [ - "*" - ], - "autocomplete": [ - "*" - ], - "autocorrect": [ - "*" - ], - "autofocus": [ - "*" - ], - "autopictureinpicture": [ - "*" - ], - "autoplay": [ - "*" - ], - "axis": [ - "*" - ], - "background": [ - "*" - ], - "behavior": [ - "*" - ], - "bgcolor": [ - "*" - ], - "border": [ - "*" - ], - "bordercolor": [ - "*" - ], - "capture": [ - "*" - ], - "cellpadding": [ - "*" - ], - "cellspacing": [ - "*" - ], - "challenge": [ - "*" - ], - "char": [ - "*" - ], - "charoff": [ - "*" - ], - "charset": [ - "*" - ], - "checked": [ - "*" - ], - "cite": [ - "*" - ], - "class": [ - "*" - ], - "classid": [ - "*" - ], - "clear": [ - "*" - ], - "code": [ - "*" - ], - "codebase": [ - "*" - ], - "codetype": [ - "*" - ], - "color": [ - "*" - ], - "cols": [ - "*" - ], - "colspan": [ - "*" - ], - "compact": [ - "*" - ], - "content": [ - "*" - ], - "contenteditable": [ - "*" - ], - "controls": [ - "*" - ], - "controlslist": [ - "*" - ], - "conversiondestination": [ - "*" - ], - "coords": [ - "*" - ], - "crossorigin": [ - "*" - ], - "csp": [ - "*" - ], - "data": [ - "*" - ], - "datetime": [ - "*" - ], - "declare": [ - "*" - ], - "decoding": [ - "*" - ], - "default": [ - "*" - ], - "defer": [ - "*" - ], - "dir": [ - "*" - ], - "direction": [ - "*" - ], - "dirname": [ - "*" - ], - "disabled": [ - "*" - ], - "disablepictureinpicture": [ - "*" - ], - "disableremoteplayback": [ - "*" - ], - "disallowdocumentaccess": [ - "*" - ], - "download": [ - "*" - ], - "draggable": [ - "*" - ], - "elementtiming": [ - "*" - ], - "enctype": [ - "*" - ], - "end": [ - "*" - ], - "enterkeyhint": [ - "*" - ], - "event": [ - "*" - ], - "exportparts": [ - "*" - ], - "face": [ - "*" - ], - "for": [ - "*" - ], - "form": [ - "*" - ], - "formaction": [ - "*" - ], - "formenctype": [ - "*" - ], - "formmethod": [ - "*" - ], - "formnovalidate": [ - "*" - ], - "formtarget": [ - "*" - ], - "frame": [ - "*" - ], - "frameborder": [ - "*" - ], - "headers": [ - "*" - ], - "height": [ - "*" - ], - "hidden": [ - "*" - ], - "high": [ - "*" - ], - "href": [ - "*" - ], - "hreflang": [ - "*" - ], - "hreftranslate": [ - "*" - ], - "hspace": [ - "*" - ], - "http-equiv": [ - "*" - ], - "id": [ - "*" - ], - "imagesizes": [ - "*" - ], - "imagesrcset": [ - "*" - ], - "importance": [ - "*" - ], - "impressiondata": [ - "*" - ], - "impressionexpiry": [ - "*" - ], - "incremental": [ - "*" - ], - "inert": [ - "*" - ], - "inputmode": [ - "*" - ], - "integrity": [ - "*" - ], - "invisible": [ - "*" - ], - "is": [ - "*" - ], - "ismap": [ - "*" - ], - "keytype": [ - "*" - ], - "kind": [ - "*" - ], - "label": [ - "*" - ], - "lang": [ - "*" - ], - "language": [ - "*" - ], - "latencyhint": [ - "*" - ], - "leftmargin": [ - "*" - ], - "link": [ - "*" - ], - "list": [ - "*" - ], - "loading": [ - "*" - ], - "longdesc": [ - "*" - ], - "loop": [ - "*" - ], - "low": [ - "*" - ], - "lowsrc": [ - "*" - ], - "manifest": [ - "*" - ], - "marginheight": [ - "*" - ], - "marginwidth": [ - "*" - ], - "max": [ - "*" - ], - "maxlength": [ - "*" - ], - "mayscript": [ - "*" - ], - "media": [ - "*" - ], - "method": [ - "*" - ], - "min": [ - "*" - ], - "minlength": [ - "*" - ], - "multiple": [ - "*" - ], - "muted": [ - "*" - ], - "name": [ - "*" - ], - "nohref": [ - "*" - ], - "nomodule": [ - "*" - ], - "nonce": [ - "*" - ], - "noresize": [ - "*" - ], - "noshade": [ - "*" - ], - "novalidate": [ - "*" - ], - "nowrap": [ - "*" - ], - "object": [ - "*" - ], - "open": [ - "*" - ], - "optimum": [ - "*" - ], - "part": [ - "*" - ], - "pattern": [ - "*" - ], - "ping": [ - "*" - ], - "placeholder": [ - "*" - ], - "playsinline": [ - "*" - ], - "policy": [ - "*" - ], - "poster": [ - "*" - ], - "preload": [ - "*" - ], - "pseudo": [ - "*" - ], - "readonly": [ - "*" - ], - "referrerpolicy": [ - "*" - ], - "rel": [ - "*" - ], - "reportingorigin": [ - "*" - ], - "required": [ - "*" - ], - "resources": [ - "*" - ], - "rev": [ - "*" - ], - "reversed": [ - "*" - ], - "role": [ - "*" - ], - "rows": [ - "*" - ], - "rowspan": [ - "*" - ], - "rules": [ - "*" - ], - "sandbox": [ - "*" - ], - "scheme": [ - "*" - ], - "scope": [ - "*" - ], - "scopes": [ - "*" - ], - "scrollamount": [ - "*" - ], - "scrolldelay": [ - "*" - ], - "scrolling": [ - "*" - ], - "select": [ - "*" - ], - "selected": [ - "*" - ], - "shadowroot": [ - "*" - ], - "shadowrootdelegatesfocus": [ - "*" - ], - "shape": [ - "*" - ], - "size": [ - "*" - ], - "sizes": [ - "*" - ], - "slot": [ - "*" - ], - "span": [ - "*" - ], - "spellcheck": [ - "*" - ], - "src": [ - "*" - ], - "srcdoc": [ - "*" - ], - "srclang": [ - "*" - ], - "srcset": [ - "*" - ], - "standby": [ - "*" - ], - "start": [ - "*" - ], - "step": [ - "*" - ], - "style": [ - "*" - ], - "summary": [ - "*" - ], - "tabindex": [ - "*" - ], - "target": [ - "*" - ], - "text": [ - "*" - ], - "title": [ - "*" - ], - "topmargin": [ - "*" - ], - "translate": [ - "*" - ], - "truespeed": [ - "*" - ], - "trusttoken": [ - "*" - ], - "type": [ - "*" - ], - "usemap": [ - "*" - ], - "valign": [ - "*" - ], - "value": [ - "*" - ], - "valuetype": [ - "*" - ], - "version": [ - "*" - ], - "virtualkeyboardpolicy": [ - "*" - ], - "vlink": [ - "*" - ], - "vspace": [ - "*" - ], - "webkitdirectory": [ - "*" - ], - "width": [ - "*" - ], - "wrap": [ - "*" - ] - } -}