`process_style_loom` adds the `style` attribute to the HTML allowlist for any configured tag, but the sanitization config only allowlists attributes and doesn’t restrict which CSS properties/values are permitted. This effectively allows arbitrary inline CSS on those elements (including tags like `table`/`td` that previously didn’t allow `style`). Consider restricting allowed CSS properties to the configured set (e.g., via an nh3 attribute filter) or otherwise ensuring inline CSS is safely constrained.

[matthiask]

process_style_loom adds the style attribute to the HTML allowlist for any configured tag, but the sanitization config only allowlists attributes and doesn’t restrict which CSS properties/values are permitted. This effectively allows arbitrary inline CSS on those elements (including tags like table/td that previously didn’t allow style). Consider restricting allowed CSS properties to the configured set (e.g., via an nh3 attribute filter) or otherwise ensuring inline CSS is safely constrained.

Originally posted by @Copilot in #78 (comment)