#2169·gollum

Why are macros disallowed to add javascript

Author: morusCreated Apr 14, 2026Updated Apr 16, 2026

I wrote a structured global toc macro that lists all pages with their folder structure. (similar to what #2101 talks about)

Now to open or collapse folders I need have some JS provided with the macro. Unfortunately script tags in macro output are sanitized.

While I understand the need to sanitize wiki user input (wiki pages) I'm not so sure about macro output.

Would it be possible to change that behavior?

If it seems to dangerous to have JS with the main output of a macro, it might be possible to allow macros to have an additional javascript method, that just provides JS. Thus is would be possible to keep the existing behavior for existing macros but allow JS in the future.

I am aware of the --js option and will use it for now but it feels wrong to depend a macro on that.

(I can also sabotage the sanitization by overwriting Gollum::Sanitization#clean method, but then all content will be unsafe)