Skip to content

HTML sanitizer allows <map> but strips <area>, making image maps unusable #4348

Description

@wesleybl

BUG/PROBLEM REPORT (OR OTHER COMMON ISSUE)

What I did:

I noticed that the HTML sanitizer allows the <map> element by default, but strips its required child element <area>.

I am aware that it is possible to customize the allowed tags and explicitly add <area>. However, since <map> is already part of the default safe HTML whitelist, I believe <area> should also be allowed by default.

For example:

<img src="image.png" usemap="#example-map">

<map name="example-map">
  <area shape="rect" coords="0,0,100,100" href="/example" alt="Example">
</map>

After saving the content, the <map> element is preserved, but the <area> element is removed.

What I expect to happen:

Since <map> is allowed by default, <area> should also be allowed by default so that HTML image maps work out of the box. The existing attribute and URL sanitization rules should continue to apply.

What actually happened:

The sanitizer preserves <map> but removes all <area> elements, leaving an empty and non-functional image map.

What version of Plone/ Addons I am using:

  • Plone: 6.1.4

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions