Python Bleach: is there any way to strip tags that are disallowed rather than allowed?

Question

I am aware that Bleach takes a list of ALLOWED_TAGS and strips out any tags not in that list when performing clean().

Is there a way to flip that around and strip tags based on those that are defined as disallowed? In other words, start by assuming everything is allowed, but then strip any tags that are not permitted.

For example, if there was a DISALLOWED_TAGS setting, anything in that list would be stripped. I'm not aware of any option like this, however.

I thought about setting ALLOWED_TAGS to a function (as ALLOWED_ATTRIBUTES allows) but it only seems to accept a list.

I am similarly interested in whether this can be done for ALLOWED_STYLES.

I am just looking at this from a theoretical standpoint and not whether it's actually best practice.

Answer 1

No, specifically for Bleach, there is no way and it will not be supported in the future. The first entry on the page with project goals says Bleach will...

Always take a allowed-list-based approach

Bleach should always take a allowed-list-based approach to markup filtering. Specifying disallowed lists is error-prone and not future proof.

For example, you should have to opt-in to allowing the onclick attribute, not opt-out of all the other on* attributes. Future versions of HTML may add new event handlers, like ontouch, that old disallow would not prevent.