Content Filtering

These options control which HTML elements, attributes, and styles are allowed in editor content, how entities are encoded, and various security-related settings.

Schema and validation

Option	Type	Default	Description
schema	string	'html5'	HTML schema used to validate content.
verify_html	boolean	true	Validate HTML against the schema on input and output.
valid_elements	string	—	Rules defining which elements and attributes are valid. Replaces the default set entirely. Uses a compact rule syntax.
extended_valid_elements	string	—	Additional valid element rules added on top of the defaults. Same syntax as valid_elements.
invalid_elements	string	—	Comma-separated list of element names to strip from content.
valid_children	string	—	Rules for which elements are allowed as children of other elements.
custom_elements	string	—	Comma-separated custom element names to add to the schema so they are not stripped.

Attributes and styles

Option	Type	Default	Description
valid_classes	string/object	—	Restrict which CSS classes are allowed. Pass a string for a global rule or an object keyed by element name.
valid_styles	string/object	—	Restrict which inline styles are allowed. Same format as valid_classes.
invalid_styles	string/object	—	Inline styles to strip from content. Same format as valid_classes.

Cleanup and formatting

Option	Type	Default	Description
fix_list_elements	boolean	false	Automatically fix improperly nested list elements.
remove_trailing_brs	boolean	true	Remove trailing <br> tags that browsers insert at the end of blocks.
pad_empty_with_br	boolean	false	Pad empty block elements with <br> instead of &nbsp;.
preserve_cdata	boolean	false	Preserve CDATA sections in content instead of converting them to comments.
element_format	string	'html'	Output format for void elements. 'html' produces <br>, 'xhtml' produces <br />.

Entity encoding

Option	Type	Default	Description
entity_encoding	string	'named'	How entities are encoded in the output. 'named' uses HTML entity names, 'numeric' uses numeric codes, 'raw' outputs raw characters.
entities	string	—	Custom entity definition string, as semicolon-separated name/value pairs.
encoding	string	—	Output encoding. Set to 'xml' to produce XML-compatible output.

Content protection

Option	Type	Default	Description
protect	RegExp[]	—	Array of regular expressions matching content that should be protected from the parser and filtering.
convert_fonts_to_spans	boolean	true	Convert deprecated <font> elements to <span> elements with inline styles. Deprecated option.
inline_styles	boolean	true	Use inline styles instead of HTML attributes for formatting. Deprecated option.

Security

Option	Type	Default	Description
xss_sanitization	boolean	true	Enable XSS sanitization of content.
allow_conditional_comments	boolean	false	Allow HTML conditional comments in content.
allow_html_data_urls	boolean	false	Allow data: URLs in HTML attributes.
allow_svg_data_urls	boolean	—	Allow data: URLs specifically for SVG content.
allow_unsafe_link_target	boolean	false	Allow target="_blank" on links without automatically adding rel="noopener".
allow_script_urls	boolean	false	Allow javascript: URLs in href and src attributes.
allow_html_in_named_anchor	boolean	false	Allow HTML content inside named anchor elements.
sandbox_iframes	boolean	true	Add a sandbox attribute to all <iframe> elements in content. Enabled by default in Editor42 as the fix for CVE-2024-29203 (upstream TinyMCE 6 defaults to false) — see Security.
convert_unsafe_embeds	boolean	true	Convert potentially unsafe <object> and <embed> elements to safer alternatives. Enabled by default in Editor42 as the fix for CVE-2024-29881 (upstream TinyMCE 6 defaults to false) — see Security.

Example

editor42.init({
  selector: 'textarea',
  valid_elements: 'p,br,strong/b,em/i,a[href|target],ul,ol,li,h1,h2,h3',
  invalid_elements: 'script,iframe',
  entity_encoding: 'raw',
  xss_sanitization: true,
  allow_script_urls: false,
  sandbox_iframes: true
});