It excludes all html tags and attributes except for those that are
whitelisted using the same lists as used by Mark Pilgrim's Universal Feed
Parser, documented at <http://feedparser.org/docs/html-sanitization.html>.
-Notably it strips `style`, `link`, and the `style` attribute.
+Notably it strips `style` and `link`.
+
+For the `style` attribute, it varys slightly from the Universal Feed
+Parser, accepting simple alphanumeric style attributes (style="foo"), but
+stripping anything more complex to avoid any of the ways to insert
+JavaScript via style attributes.
It uses the [[cpan HTML::Scrubber]] perl module to perform its html
sanitisation, and this perl module also deals with various entity encoding
* <span style="background: url(javascript:window.location='http://example.org/')">CSS script test</span>
* <span style="any: expression(window.location='http://example.org/')">entity-encoded CSS script test</span>
* <span style="any: expression(window.location='http://example.org/')">entity-encoded CSS script test</span>
+* <span style="pretty">OTOH, this is ok, and will be accepted</a>