Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
Discussion options

Hi, I know tinymce does source code sanitization and modification by design. But I have a case that I don't want to make it happen (I think there are other people that want this too). In my project, I am using tinymce to create templates that use handlebar tags. For example:

when I put <img src="data:image/jpeg;base64,{{SOME_SRC}}" /> this img tag with this source (this SOME_SRC will be populated later, this is handle bar tag) and in first tinymce's modification it becomes this <img src="data:;base64,{{SOME_SRC}}" /> this. And If I refresh the page saving this template, it just becomes <img />. The src is removed, I guess this sanitization that is being made in editor's initialization is different.
I don't want it to happen. I got around other cases even with this sanitization, now this is the only problem for me.
I want to solve this problem, and If it is possible, can there be any way stop this source code modification altogether

Thank you

You must be logged in to vote

Replies: 2 comments

Comment options

Hi @altai861! You should begin reading our security guide, it contains the details to get you started: https://www.tiny.cloud/docs/tinymce/latest/security/

— Fredrik, Product Manager

You must be logged in to vote
0 replies
Comment options

@altai861 Hi, have you figure out how to prevent the sanitization? I tried using xss_sanitization: false, & SAFE_FOR_XML: false, but my xhtml file is still striped.

You must be logged in to vote
0 replies
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
3 participants
Converted from issue

This discussion was converted from issue #10230 on March 19, 2025 05:47.

Morty Proxy This is a proxified and sanitized view of the page, visit original site.