HTML / CSS / JS
Pages can use real HTML alongside wiki markup — inside a strict sandbox. The model is simple to state:
- Tags are allowlisted. Only a curated set of tags is kept
(the full list). Anything else —
<script>,<iframe>, an unknown tag, a typo — is escaped and shown as literal text, never silently removed. If you see raw<tag>text on a page, the sanitizer is telling you that tag isn’t allowed. - Attributes are filtered. Each tag keeps a small set of allowed
attributes (the full list); everything
else is dropped.
on*event handlers are always dropped.classvalues are filtered to simple tokens;data-*attributes don’t survive. - CSS is sanitized. Inline
style="…"is pattern-checked and<style>blocks are scoped to the article — details on the CSS page and in What’s blocked. - JavaScript does not exist. No script tags, no event handlers, no
javascript:URLs. There is no way to run author code on this wiki, by design — that’s what keeps hover tooltips, previews, and reader settings safe.
The allowlist pages (tags, attributes, what’s blocked) are generated from the engine’s sanitizer source on every docs build — they cannot drift from what’s actually enforced.
The two rules that surprise people
- No raw
<a>or<img>. Links are wiki syntax —[[Page]],[https://example.com label]— and images are![[File.png]]. The HTML forms render as escaped text. - Wiki markup keeps working inside allowed HTML. A
<div>can contain headings, links, includes, and tables; the sandbox filters tags, it doesn’t switch parsing off. (To show something literally, that’s<nowiki>.)