jcho

This is from Chrome and Safari. Firefox has a whole set of other problems and it is not usable for editing text.

[clabot:check]

If this command is considered too dangerous because it allows an arbitrary attribute to be inserted, we can add an explicit check of the added attribute names, so that only...

I looked at the MDN doc on the span element to see on what attributes an attacker may potentially insert JavaScript code. From my review, it seems clear that event-handler...

To make `\htmlAttr` logically equivalent to the union of existing `\htmlId``\htmlClass` `\htmlStyle`, and `\htmlData` commands, I can add the following validation logic to `\htmlAttr`: (1) limit allowed attribute names to...

@ylemkimon Thank you very much. I just updated the pull request to allow only id, style, class, and data- attributes in `\htmlAttr` Regarding attribute-value validation, I find that the existing...

For my current need, `na_strings = [""]`, is a good enough workaround because I don't have any NA value in any column. I was quite surprised with this issue when...