Which inline HTML styles does GitHub Markdown accept?
After GitHub converts Markdown to HTML,
The HTML is sanitized, aggressively removing things that could harm you and your kin—such as
script
tags, inline-styles, andclass
orid
attributes. See the sanitization filter for the full whitelist.
You're right: style
tags are not included in the whitelist. They are ignored.
The permitted attributes differ by tag. I recommend referring to the sanitization filter link above. It leads to a fairly readable Ruby source file.
abalter
Updated on June 06, 2022Comments
-
abalter almost 2 years
This gives a pretty thorough description of how HTML elements are interpreted by Markdown. But it does not discuss styles.
So far, the only thing I can get to work is image width.
- I can't find a list anywhere of what is accepted/rendered
- It appears that the
style="....."
attribute is completely ignored. - I can't even find a list of the old-fashioned style attributes (as opposed to the style attribute
style=...
)
https://gist.github.com/abalter/46df1b79e9f429342972477d7c20cebc
Change
span
todiv
due todiv
being in the whitelisted tags per @waylan's comment under @chris's answer.It appears that Firefox and Chrome don't render any style attributes any more at all.
-
abalter almost 7 yearsSo, if I'm interpreting
:all => ['abbr', ...
correctly, then both "color" and "border" should work. They did not work in my example. -
Waylan almost 7 yearsMake note of the elements whitelist.
span
is not on that list. In fact, if you check the HTML in your example (use "view source" in your browser), the span is completely stripted out. Only the text contents remain. I would suggest using one of the elements in the whitelist instead. -
Chris almost 7 yearsYes, good point Waylan. This isn't just about attributes, but whole tags as well.
-
abalter almost 7 yearsI've changed
span
todiv
and I'm still not getting the styles. Also,img
is in the tag list, but I'm not getting the styles for it either---except for thewidth
old-fashioned inline attribute. -
abalter almost 7 yearsNow the HTML is rendering as
<div color="red" border="10" size="48px">hello</div>
But none of the styles are displaying. -
abalter almost 7 yearsUh, it appears that firefox and chrome don't render individual attributes any more at all. So it doesn't matter if github has whitelisted them.