Sanitize a raw HTML string with Foundry's built-in allowlist sanitizer,
foundry.utils.cleanHTML — the same sanitizer Foundry applies to dialog and
journal-entry HTML. It rebuilds the fragment through the browser parser and
keeps only tags in ALLOWED_HTML_TAGS and attributes in
ALLOWED_HTML_ATTRIBUTES, and validates URL-bearing attributes (href,
src, …) against ALLOWED_URL_SCHEMES via URL.parse. This neutralizes
<script>, on* event handlers, whitespace/entity-obfuscated javascript:
URLs, <base>, SVG xlink:href, surviving inline style, and the
sanitize→serialize→reparse mutation-XSS (mXSS) that a tag/attribute denylist
misses (issue #161).
foundry.utils.cleanHTML is a real client-side v14 API but is currently
absent from fvtt-types, so it is reached through an explicit cast here — the
one sanctioned place to touch the Foundry global.
Note: ALLOWED_URL_SCHEMES includes data, so data: URLs are permitted,
matching Foundry's system-wide stance rather than being additionally blocked.
See the HTML-rendering guardrail in the
Security Model doc.
Sanitize a raw HTML string with Foundry's built-in allowlist sanitizer,
foundry.utils.cleanHTML— the same sanitizer Foundry applies to dialog and journal-entry HTML. It rebuilds the fragment through the browser parser and keeps only tags inALLOWED_HTML_TAGSand attributes inALLOWED_HTML_ATTRIBUTES, and validates URL-bearing attributes (href,src, …) againstALLOWED_URL_SCHEMESviaURL.parse. This neutralizes<script>,on*event handlers, whitespace/entity-obfuscatedjavascript:URLs,<base>, SVGxlink:href, surviving inlinestyle, and the sanitize→serialize→reparse mutation-XSS (mXSS) that a tag/attribute denylist misses (issue #161).foundry.utils.cleanHTMLis a real client-side v14 API but is currently absent fromfvtt-types, so it is reached through an explicit cast here — the one sanctioned place to touch the Foundry global.Note:
ALLOWED_URL_SCHEMESincludesdata, sodata:URLs are permitted, matching Foundry's system-wide stance rather than being additionally blocked. See the HTML-rendering guardrail in the Security Model doc.