[ShaneCurran]

I guess a nested, parameter-granularity whitelist would work in that case :)

[_urga]

You can do that with DOMPurify using hooks.