Frontend & browser·Browser security
you needed to accept formatted text, so you parsed it and stripped everything not on the allowed list.
HTML sanitisation
Also calledsanitizer, allowlist filtering
Parsing untrusted markup and removing anything not on an explicit allowlist of elements and attributes, for the case where you genuinely must render user HTML. It has to be allowlist-based and it has to run on a real parser, because blocklists and regexes lose to parser quirks every time. Use a maintained library or the platform's own Sanitizer API; a hand-written one is a vulnerability with a delay on it.