Which inline HTML styles does GitHub Markdown accept?

11,983

After GitHub converts Markdown to HTML,

The HTML is sanitized, aggressively removing things that could harm you and your kin—such as script tags, inline-styles, and class or id attributes. See the sanitization filter for the full whitelist.

You're right: style tags are not included in the whitelist. They are ignored.

The permitted attributes differ by tag. I recommend referring to the sanitization filter link above. It leads to a fairly readable Ruby source file.

Share:
11,983
abalter
Author by

abalter

Updated on June 06, 2022

Comments

  • abalter
    abalter almost 2 years

    This gives a pretty thorough description of how HTML elements are interpreted by Markdown. But it does not discuss styles.

    So far, the only thing I can get to work is image width.

    1. I can't find a list anywhere of what is accepted/rendered
    2. It appears that the style="....." attribute is completely ignored.
    3. I can't even find a list of the old-fashioned style attributes (as opposed to the style attribute style=...)

    https://gist.github.com/abalter/46df1b79e9f429342972477d7c20cebc


    Change span to div due to div being in the whitelisted tags per @waylan's comment under @chris's answer.

    It appears that Firefox and Chrome don't render any style attributes any more at all.

  • abalter
    abalter almost 7 years
    So, if I'm interpreting :all => ['abbr', ... correctly, then both "color" and "border" should work. They did not work in my example.
  • Waylan
    Waylan almost 7 years
    Make note of the elements whitelist. span is not on that list. In fact, if you check the HTML in your example (use "view source" in your browser), the span is completely stripted out. Only the text contents remain. I would suggest using one of the elements in the whitelist instead.
  • Chris
    Chris almost 7 years
    Yes, good point Waylan. This isn't just about attributes, but whole tags as well.
  • abalter
    abalter almost 7 years
    I've changed span to div and I'm still not getting the styles. Also, img is in the tag list, but I'm not getting the styles for it either---except for the width old-fashioned inline attribute.
  • abalter
    abalter almost 7 years
    Now the HTML is rendering as <div color="red" border="10" size="48px">hello</div> But none of the styles are displaying.
  • abalter
    abalter almost 7 years
    Uh, it appears that firefox and chrome don't render individual attributes any more at all. So it doesn't matter if github has whitelisted them.