title: SafeHtml Bean Validation, allow HTML element attributes, while rejecting possibly malicious tags (i.e. <script>...)
body: <p>I have a Java based back end in which I'm using Hibernate for some more specific bean validation, namely: @SafeHtml. It works great for 99% of my needs, however I have an part which allows a user to enter basic HTML to create their own page and I need to be less restrictive here.</p>
  
  <p>My problem is that I want to restrict certain types of HTML elements (i.e. '' tags etc...), while allowing attributes for the HTML elements I deem appropriate (i.e. ) . As far as I've been able to see, @SafeHtml doesn't allow any attributes unless explicitly defined like the following:</p>
  
  <pre><code>@SafeHtml ( 
      whitelistType = WhiteListType.RELAXED,
      additionalTagsWithAttributes = {
          @Tag(name = "div", attributes = {"class", "style"},
          @Tag(name = "anotherTag", attributes = {"id", "anotherAttribute"}
  
      }
  )
  </code></pre>
  
  <p>Hopefully, you can see the problem with this, to allow even a small subset of tags, with their attributes enabled, would be incredibly verbose and wasteful, not to mention it would be easy to miss something with all the tags and attributes out there.</p>
  
  <p>So... my question is: Is there a better way to do this? It seems like it shouldn't be that unique of a situation: i.e. you want to validate user input that's HTML, but only want to reject script tags...</p>