---
title: "Ui: sanitizer"
description: "smabar plugin reference: Ui: sanitizer"
canonical: "https://smabar.com/docs/plugin-ref-ui-sanitizer/"
lang: en
---

# Ui: sanitizer

> smabar plugin reference: Ui: sanitizer

Canonical HTML version: https://smabar.com/docs/plugin-ref-ui-sanitizer/ · Language: en · Publisher: smabar (https://smabar.com)

---

[Build my plugin](https://smabar.com/build-my-plugin.md) · [All references](https://smabar.com/docs/plugin-ref-index.md) · [Install the ZIP](https://smabar.com/docs/install-plugin-zip.md)

Source: smabar 1.5.0, revision `a019f2563965edc37a5e8d84742ea1ff2fa6f824`. [Export metadata and checksums](https://smabar.com/plugin-reference/export.json).

This is an offline reference. MCP calls quoted below describe the connected workflow; use the linked documents and create local files instead. Live state, installed plugins, available providers and the user's active theme are unknown. Never claim a live check.

Read with [styling](https://smabar.com/docs/plugin-ref-styling.md) and [examples](https://smabar.com/docs/plugin-ref-examples.md).

## allowedTags

```json
[
  "a",
  "abbr",
  "article",
  "aside",
  "audio",
  "b",
  "blockquote",
  "br",
  "button",
  "caption",
  "code",
  "col",
  "colgroup",
  "datalist",
  "dd",
  "details",
  "dialog",
  "div",
  "dl",
  "dt",
  "em",
  "fieldset",
  "figcaption",
  "figure",
  "footer",
  "form",
  "h1",
  "h2",
  "h3",
  "h4",
  "h5",
  "h6",
  "header",
  "hr",
  "i",
  "iframe",
  "img",
  "input",
  "kbd",
  "label",
  "legend",
  "li",
  "main",
  "mark",
  "meter",
  "nav",
  "ol",
  "optgroup",
  "option",
  "output",
  "p",
  "picture",
  "pre",
  "progress",
  "s",
  "samp",
  "section",
  "select",
  "small",
  "source",
  "span",
  "strong",
  "sub",
  "summary",
  "sup",
  "table",
  "tbody",
  "td",
  "textarea",
  "tfoot",
  "th",
  "thead",
  "time",
  "track",
  "tr",
  "u",
  "ul",
  "var",
  "video",
  "wbr"
]
```

## droppedTags

```json
[
  "embed",
  "link",
  "meta",
  "object",
  "script",
  "style",
  "template"
]
```

## allowedAttrs

```json
[
  "alt",
  "aria-busy",
  "aria-controls",
  "aria-current",
  "aria-describedby",
  "aria-disabled",
  "aria-expanded",
  "aria-haspopup",
  "aria-hidden",
  "aria-label",
  "aria-labelledby",
  "aria-live",
  "aria-modal",
  "aria-pressed",
  "aria-roledescription",
  "aria-selected",
  "class",
  "colspan",
  "datetime",
  "dir",
  "for",
  "headers",
  "hidden",
  "id",
  "lang",
  "placeholder",
  "role",
  "rowspan",
  "scope",
  "span",
  "style",
  "tabindex",
  "title"
]
```

## dataAttrPattern

```json
"^data-[a-z0-9-]+$"
```

## inputTypes

```json
[
  "checkbox",
  "color",
  "date",
  "datetime-local",
  "email",
  "month",
  "number",
  "password",
  "radio",
  "range",
  "search",
  "tel",
  "text",
  "time",
  "url",
  "week"
]
```

## inputAttrs

```json
[
  "checked",
  "cols",
  "disabled",
  "inputmode",
  "list",
  "max",
  "maxlength",
  "min",
  "minlength",
  "multiple",
  "name",
  "readonly",
  "required",
  "rows",
  "selected",
  "size",
  "step",
  "value"
]
```

## unwrappedNote

```json
"A tag that is neither allowed nor dropped is UNWRAPPED: the tag goes, its sanitized children stay. Every removal is reported into your plugin's log with the reason — see sanitizer.reporting."
```

## imgSrcRule

```json
"img src must start with http://, https://, data:image/ or sb-asset: — anything else is stripped."
```

## reporting

```json
"Nothing here fails loudly in the UI — a removed element is simply not there. Every removal IS reported into the plugin's own log as a \"shell\" entry naming what was removed, how often, and the supported alternative; read it with plugin_logs(<your plugin id>). It is logged once per distinct problem per surface, not once per render, and a clean render re-arms it, so a problem that comes back is reported again; the write reply summarises this start's reports under reload.warnings. If a tile renders but an element is missing, look there FIRST."
```

## svgTags

```json
[
  "circle",
  "defs",
  "ellipse",
  "g",
  "line",
  "linearGradient",
  "path",
  "polygon",
  "polyline",
  "radialGradient",
  "rect",
  "stop",
  "svg",
  "text",
  "tspan"
]
```

## nativeInteractionAttrs

```json
[
  "command",
  "commandfor",
  "open",
  "popover",
  "popovertarget",
  "popovertargetaction"
]
```

## commandValues

```json
[
  "close",
  "hide-popover",
  "request-close",
  "show-modal",
  "show-popover",
  "toggle-popover"
]
```

## nativeInteraction

```json
"You cannot ship JavaScript, and you do not need to for the common interactions. <details>/<summary> is an accordion. <dialog> plus a button with commandfor=\"<dialog id>\" command=\"show-modal\" is a modal, and command=\"close\" closes it; request-close preserves the dialog's cancellable cancel path. Any element with the popover attribute plus a button with popovertarget is a menu or a popup. The shell uses native activation when present and the matching showModal/close/showPopover/hidePopover API only when declarative invokers are absent, so the markup works without double activation. Give several <details> the SAME name attribute and they become an exclusive accordion: opening one closes its siblings. Only the built-in command values are honoured: close, hide-popover, request-close, show-modal, show-popover, toggle-popover."
```

## svg

```json
"Inline <svg> is allowed for shapes, text and gradients (circle, defs, ellipse, g, line, linearGradient, path, polygon, polyline, radialGradient, rect, stop, svg, text, tspan). <use>, <script>, <foreignObject>, <animate> and <set> are not — those leave the SVG subtree. For icons prefer data-lucide and for charts data-chart; they are smaller and follow the theme."
```

## forms

```json
"<form> supports <label for> and native validation; action, method, target and enctype are stripped. A valid submit (click or Enter) sends the chosen submit button's data-action exactly once, with data-value or the collected data-field values. Invalid forms send nothing and never navigate. Give non-submit actions type=button."
```

## svgAttrs

```json
[
  "aria-hidden",
  "aria-label",
  "aria-labelledby",
  "class",
  "cx",
  "cy",
  "d",
  "dx",
  "dy",
  "fill",
  "fill-opacity",
  "fill-rule",
  "gradientUnits",
  "height",
  "id",
  "offset",
  "opacity",
  "points",
  "r",
  "role",
  "rx",
  "ry",
  "stop-color",
  "stop-opacity",
  "stroke",
  "stroke-dasharray",
  "stroke-dashoffset",
  "stroke-linecap",
  "stroke-linejoin",
  "stroke-opacity",
  "stroke-width",
  "style",
  "text-anchor",
  "transform",
  "viewBox",
  "width",
  "x",
  "x1",
  "x2",
  "y",
  "y1",
  "y2"
]
```

## buttonTypes

```json
[
  "button",
  "reset",
  "submit"
]
```

## perTagAttrs

```json
{
  "iframe/img/video/canvas width, height": "plain pixel counts, so the box is reserved before the file loads and the flyout does not jump",
  "autofocus": "kept only on a control inside a <dialog>; elsewhere it would steal focus on every re-render",
  "a href inside [data-sb-lightbox]": "may carry an sb-asset: path — it is the full image the viewer opens, not a destination"
}
```