title: OWSP Java Encoder: prevent specific attributes from being escaped
body: <p>I'm cleaning the third-party HTML content using the <a href="https://github.com/alxlit/autoclave" rel="nofollow noreferrer">Clojure's wrapper</a> on OWSP Java Encoder library. I've prepared a policy that keeps <code>src</code> attribute on <code>iframe</code> elements if it matches some regex templates, e.g. YouTube or Vkontakte embedded iframes.</p>
  
  <p>However, the final <code>src</code> value is escaped so the URL doesn't work. Here is an example. The source HTML:</p>
  
  <pre><code>&lt;iframe src='https://vk.com/video_ext.php?oid=-30493961&amp;id=456241043&amp;hash=a3148de1cd04c77b' width='640' height='360' frameborder='0' allowfullscreen&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>And the result:</p>
  
  <pre><code>&lt;iframe src="https://vk.com/video_ext.php?oid&amp;#61;-30493961&amp;amp;id&amp;#61;456241043&amp;amp;hash&amp;#61;a3148de1cd04c77b"&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>I didn't manage to find any docs on how to prevent the returned <code>src</code> value from being escaped. How can I do that?</p>
  
  <p>PS my source code:</p>
  
  <pre><code>;; policy declaration
  (html-policy
     :allow-elements ["iframe"] ;; a long vector here with other tags
  
     :allow-attributes
     ["src"
      :matching [#"(?i)\Qhttps://vk.com/video_ext.php\E.+"]
      :on-elements ["iframe"]]
  
     :allow-standard-url-protocols)
  
  ;; sanitation
  (html-sanitize policy html-string)
  </code></pre>