Working with the ArcGIS JavaScript API version 4.13 and was able to build popup templates that included data attributes to work with the Semantic UI library for their Tab module (https://semantic-ui.com/modules/tab.html). I recently upgraded to version 4.16 and now the template is broken. Upon examining the html when rendered it strips key data-attributes for tabs (data-tab) prevent it from working. Is there a way to force explicit content and prevent the template from being modified in version 4.16 or if this expected going forward?

Example (Click on the map to launch the popup)


This was a security enhancement and should be expected going forwarded.

The HTML sanitizer was added to all widgets to sanitize and escape strings according to the ArcGIS Online supported HTML specification. This can cause HTML set in PopupTemplate.content or in other widgets to be removed.

At version 4.15, we relaxed "some of the sanitizing rules when displaying HTML to be less restrictive than the ArcGIS Online supported HTML specification".


You can read more at https://www.esri.com/arcgis-blog/products/js-api-arcgis/mapping/using-html-with-popups-in-the-arcgis-api-for-javascript/ but in essence, if your HTML is sanitized, a work-around is to use a function to modify the DOM node of the popup directly.

  • This is probably the wrong forum for this, but..... I disagree with stripping data- attributes while sanitizing the HTML. There's probably not much you could do with a data- attribute that's nefarious, but a lot of good things are restricted if you remove them. – Stephen Lead Oct 21 '20 at 3:17
  • 1
    Hi @StephenLead - yes, this is the wrong forum for that :) A better place would be github.com/Esri/arcgis-html-sanitizer/issues Thank you. – Bjorn Svensson Oct 21 '20 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.