Why are HTML attributes missing in a Bootstrap 4 popover?

Question

$(document).ready(function () {
        $("[data-toggle=popover]").popover({
            html: true,
            content: function () {
                return "<div style='color:red;'>test</div>";
            }
        });
});

<script src="https://code.jquery.com/jquery-3.2.1.slim.min.js" integrity="sha384-KJ3o2DKtIkvYIK3UENzmM7KCkRr/rE9/Qpg6aAZGJwFDMVNA/GpGFF93hXpG5KkN" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js" integrity="sha384-ApNbgh9B+Y1QKtv3Rn7W3mgPxhU9K/ScQsAP7hUibX39j7fakFPskvXusvfa0b4Q" crossorigin="anonymous"></script>
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css" integrity="sha384-Gn5384xqQ1aoWXA+058RXPxPg6fy4IWvTNh0E263XmFcJlSAwiGgFAW/dAiS6JXm" crossorigin="anonymous">
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js" integrity="sha384-JZR6Spejh4U02d8jOt6vLEHfe/JQGiRRSQQxSfFWpi1MquVdAyjUar5+76PVCmYl" crossorigin="anonymous"></script>

<a class="btn btn-primary" data-html="true" data-toggle="popover" data-placement="bottom">Click Me</a>

When I use HTML content in a Bootstrap 4 popover, the HTML attributes are missing. I expect to see red text, but it outputs the div tag without the red style.

    $("[data-toggle=popover]").popover({
        html: true,
        content: function () {
            return "<div style='color: red;'>Test</div>";
        }
    });

Answer 1

Bootstrap popovers perform some sanitizing to strip "unsafe" attributes - and it's turned on by default.

Contradicting my previous comment and my tests, it has been default even in older versions. It's always good to know the manual :-)

https://getbootstrap.com/docs/4.4/components/popovers/#options

Allowed attributes are defined tagwise:

https://getbootstrap.com/docs/3.4/javascript/#js-sanitizer

It can be switched off setting the sanitize option to false.

$("[data-toggle=popover]").popover({
  html: true,
  sanitize: false,
  content: function () {
    return "<div style='color: red;'>Test</div>";
  }
});