What code does the RCE Sanitize?

[themidiman]

After doing a bit of research into using embed code for Amara.org, it would appear that the RCE sanitizes HTML5 data-* attributes. I'm well aware that JavaScript code is stripped out for very good reasons, but this seems like an oversight. Is there a document on the community site that has more details on what is stripped out of Canvas when a resource with the RCE is used (i.e. Pages, Assignments, Announcements, Discussions, etc.)?

Thanks in advance.

[awilliams · Accepted solution]

Hey JEFHQ12951​, in the guide How do I use the HTML view in the Rich Content Editor? there is a link to an HTML Whitelist PDF. It's kind of the opposite of what you're asking but hopefully it will provide the information you're looking for. Please take a moment to let us know if this has answered your question or not. If it has, click the "Correct Answer" button on this post. If it hasn't, please provide us with additional details so that we can continue to help.

[themidiman]

Thanks awilliams

What I'd like to do is get the attention of the community before I created a feature request/Idea to have the RCE to leave data-* attributes included in the whitelist. I will reference this document in the feature request.

Your response is much appreciated!

[Kathleen_cham]

Hi, Still trying to find info on the purpose, and how to use, CODE that appears under FORMAT. Faculty will want to know. Can someone point in the direction of how that is to be used in the dropdown FORMAT menu button?

[Kathleen_cham · Accepted solution]

I answered myself!

The code tag is used to define a piece of computer code. The content inside is displayed in the browser's default monospace font.

It's there for folks who want to add a snippet of code to their page and have it display differently than the rest of the text.