Request: DisallowElements function

[microcosm-cc]

Request: DisallowElements function

[buro9]

It would be plausible, and I can see that it would have a place.

On one hand... it's a whitelist, so this seems to be redundant.

On the other hand... this allows you to take rich policies and adapt them for you, and that's of value.

So long as the PR updated the ReadMe to communicate that the existence of Disallow* funcs are to support sharing of policies and that bluemonday remains a whitelist rather than a black list... then I would accept it.

[joncalhoun]

On the other hand... this allows you to take rich policies and adapt them for you, and that's of value.

Yep, but I'm not 100% sure it is valuable enough to offset the cost of maintaining extra code. 😕

I won't be able to look into this for a few weeks but will update you then. If you want to close this in the meantime feel free to. I just wanted to get your opinion before digging further.

[buro9]

I'm going to close this as a won't fix.

I'd happily take a PR for it, and that would only affect the policy.go and policy_test.go file as the construction of policy is separate to how the policy is applied... the policy object itself wouldn't have to change though for every Allow you'd need to add the corresponding Disallow.

[joncalhoun]

SGTM. Sorry this has just sat here - i've been swamped lately and this is a very low priority for me.