Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

For more information, open the CLA check for this pull request.

@AndrewKushnir , does smb plan to pick it up for review?

@amaestr0 it is not clear to me what is the motivation for this change. What is the problem that you are trying to address?

@amaestr0 it is not clear to me what is the motivation for this change. What is the problem that you are trying to address?

@pkozlowski-opensource have you read the related issue an it's description?

have you read the related issue an it's description?

@amaestr0 sure, I'm assuming that you are referring to #45270. But this is where the confusion starts. The #45270 mentions the id and style attributes, so does your PR title. But it doesn't match what is going on in the code:

• it doesn't deal with the id (good, but the PR title and the communication should be updated);
• it introduces export const UNSAFE_SPEC_ATTRS_VALUES: string[] = ['expression', 'javascript', 'script']; (and the processing of it) which I find unrelated to what it discussed in the issue / PR communication.

I'm fine if we focus on the style attribute - in fact we might no longer need to sanitize it at all, given changes done in #35621.

I'm going to close this PR for now as there is lots of noise going on here already. If we are to do changes to the style attribute sanitization we should do so in a dedicated, focused PR. But before opening a PR we should discuss if the style attribute sanitization is needed at all.

Moving the discussion back to #45270

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}