Findings No. 25
DOMPurify's default URI policy strips data: from links but permits it on images
Dangerous schemes are stripped from link hrefs, but data: URIs survive on media attributes like img src under the defaults. Read your sanitizer's URI policy and restate it in your own docs.
"Sanitized" is a policy, not a property, and DOMPurify's default URI policy draws a line worth knowing: dangerous schemes like javascript: and data: are stripped from link hrefs, but data: URIs remain permitted on media attributes such as an image's src. Pasted content that is clean by DOMPurify's defaults can therefore still carry inline data: images.
That is a reasonable default (inline images are a legitimate, common case and cannot execute script from an img src), but it matters when you reason about what sanitized paste means for storage size, content policy, or a CSP that restricts img-src. Woof Editor documents the nuance rather than silently inheriting it.
The general rule: read your sanitizer's URI policy and restate it in your own documentation, because "we sanitize pasted HTML" tells a consumer almost nothing about what survives.
Receipt: woof-editor CHANGELOG 0.2.0 (paste-sanitization note); README, Sanitization section.