diff --git a/gems/canvas_sanitize/lib/canvas_sanitize/canvas_sanitize.rb b/gems/canvas_sanitize/lib/canvas_sanitize/canvas_sanitize.rb
index 4e07f7f249555..32019818fec2d 100644
--- a/gems/canvas_sanitize/lib/canvas_sanitize/canvas_sanitize.rb
+++ b/gems/canvas_sanitize/lib/canvas_sanitize/canvas_sanitize.rb
@@ -263,6 +263,7 @@ def self.included(klass)
"mozallowfullscreen"].freeze,
"ol" => ["start", "type"].freeze,
"q" => ["cite"].freeze,
+ "time" => ["datetime"].freeze,
"table" => %w[summary width border cellpadding cellspacing center frame rules].freeze,
"tr" => %w[align valign dir].freeze,
"td" => %w[abbr axis colspan rowspan width align valign dir].freeze,
diff --git a/gems/canvas_sanitize/spec/canvas_sanitize/canvas_sanitize_spec.rb b/gems/canvas_sanitize/spec/canvas_sanitize/canvas_sanitize_spec.rb
index 2bf081df665c5..1cfe67be047f9 100644
--- a/gems/canvas_sanitize/spec/canvas_sanitize/canvas_sanitize_spec.rb
+++ b/gems/canvas_sanitize/spec/canvas_sanitize/canvas_sanitize_spec.rb
@@ -220,6 +220,12 @@
expect(res).to eq str
end
+ it "keeps datetime attribute only on time tags" do
+ str = %(June 15, 2025
June 15, 2025)
+ res = Sanitize.clean(str, CanvasSanitize::SANITIZE)
+ expect(res).to eq %(June 15, 2025
June 15, 2025)
+ end
+
Dir.glob(File.expand_path(File.join(__FILE__, "..", "..", "fixtures", "xss", "*.xss"))) do |filename|
name = File.split(filename).last
it "sanitizes xss attempts for #{name}" do
diff --git a/packages/canvas-rce/src/__tests__/defaultTinymceConfig.test.js b/packages/canvas-rce/src/__tests__/defaultTinymceConfig.test.js
index 328f11b2585b1..e0771a954b466 100644
--- a/packages/canvas-rce/src/__tests__/defaultTinymceConfig.test.js
+++ b/packages/canvas-rce/src/__tests__/defaultTinymceConfig.test.js
@@ -26,7 +26,7 @@ describe('defaultTinymceConfig', () => {
const allAllowedElements = [valid_elements, extended_valid_elements].join(',')
expect(allAllowedElements).toMatchInlineSnapshot(
- `"@[id|class|style|title|dir