jejacks0n/mercury — comment on commit 575e4451383502251f10512cecdf85dffb847d33
File: vendor/assets/javascripts/mercury.js line 254
By JeanMertz:

I see your reason for allowing `classes`. Perhaps it would be a good idea then to somehow capture the classes used in the predefined classes pop-over, and only keep those classes. But this could get complicated perhaps?

As for using jQuery.htmlClean instead of my small method, I think that is a great idea! I actually used that plugin a few months ago but completely forgot about it (I guess that's where I got the `class, ["attrs"]` idea from in the whiteList array. Anyway, I actually think it'd be better to simply swap my method for htmlClean entirely. It provides a lot more powerful features, and I highly doubt it will take more than 100 ms to complete the request, which isn't that bad at all, especially given it's far more powerful.

That still leaves the question of the `style` attribute and sanitizing that, but that's a story for a different time.