Security
Rich text HTML with explicit security boundaries
Editor content is treated as untrusted input. Tsao Editor normalizes supported markup, removes executable attributes, restricts URLs, and keeps application-defined extensions on an allowlist.
Why arbitrary source HTML is not enabled by default
Unrestricted source editing can introduce scripts, event attributes, javascript URLs, malformed table structure, unsupported nesting, and inline styles that bypass the editor model. It can also make selection, undo history, comments, and toolbar state disagree with the visible document.
The safer extension path is to register supported classes and plugin output, then sanitize both edited and readonly content with the same rules.
Built-in defenses
- Script and event-handler removal
- No inline style output
- Allowed protocol checks for links and images
- Sandbox attributes for embedded iframe content
- Class allowlists for custom formatting and plugins
- Readonly renderer sanitization before DOM insertion
Application responsibilities
Validate uploaded files on the server, apply a suitable Content Security Policy, authorize comment and AI endpoints, and sanitize content again when it crosses a different trust boundary such as email or an external CMS.