DeniedSanitizeSelectors not working

[Brian Pautsch]

I have DeniedSanitizeSelectors set to RTE_DESANITIZE_TAGS.

public static readonly string[] RTE_DESANITIZE_TAGS = { "iframe[src]" };

When I call this code:

ExecuteCommandOption execCmdOption = new ExecuteCommandOption();
execCmdOption.Undo = true;
await _rteMessage.RestoreSelectionAsync();
await _rteMessage.ExecuteCommandAsync(CommandName.InsertHTML, value, execCmdOption);

And "value" is:

<div style="padding:56.25% 0 0 0;position:relative;">
    <iframe width="560" height="315" src="https://player.vimeo.com/video/1139491180"
            frameborder="0" allowfullscreen="" class="fr-draggable"></iframe>
</div>

The only HTML I see in the editor is the "div". The iframe is still removed.

The documentation says "Gets or sets the list of selectors to be removed from the default sanitization list, allowing them in the editor.", therefore, my constant value should be correct.

Is this a bug or am I missing something?

[Vinitha Jeyakumar]

Hi Brian Pautsch,

We have considered the reported issue "DeniedSanitizeSelectors is not working properly in Blazor RichTextEditor" as a bug from our end, and the fix for the issue will be included in our upcoming weekly patch release scheduled on last week of December 2025.

 

Now you can track the status of the reported issue through this feedback,

https://www.syncfusion.com/feedback/71932/deniedsanitizeselectors-is-not-working-properly-in-blazor-richtexteditor

Regards,

Vinitha

[Brian Pautsch]

Vinitha - Did this get deployed yet?

[Vinitha Jeyakumar]

Hi  Brian Pautsch,

We have included the fix for the reported issue "DeniedSanitizeSelectors is not working properly in Blazor RichTextEditor" with our weekly patch release version 32.1.21. Please upgrade your package to the latest version to resolve the issue from your end.

Release Notes: https://blazor.syncfusion.com/documentation/release-notes/32.1.21?type=all#rich-text-editor

Root Cause: 

The reported issue occurs because the code replaced the third sanitizer rule using a fixed index (tags[2]), which unintentionally overwrote 'iframe[src]' and caused video iframes to be removed.