Allow data-* attributes

[Jarosław Jakubowski]

For now there is no way to allow all data-* attributes.

[Tobias Dammers]

I am not opposed to this in principle; one problem however is that whitelisting all data- attributes at once would defeat the purpose of the whole whitelisting approach. Data attributes are often used to control scripts, so depending on what uses them, considering them benign isn't generally justified.

Then again, if you're going to mess with the whitelists anyway, I don't see why you shouldn't have the option to do something like this. Maybe a good solution would be to allow regex-based whitelists, then you could specify something like /^data-/, if you so please, but it would also give you the flexibility to be more specific.