The HTML sanitizer allows the for attribute on all elements

The secure HTML element sanitizer (used, e.g., for HTML macros written by users without script right) allows the for attribute on every element. It is only meaningful on label and output.

The declarative partial updates proposal (experimental in Chrome) gives for a new meaning on template: <template for="name"> replaces or inserts content at a marker with that name anywhere in the page, and together with src it can load the content from a remote URL. XWiki pages don't contain such markers today and the sanitizer removes processing instructions, so this has no impact currently. However, sanitized content shouldn't be able to modify parts of the page outside of it if the feature ships and markers are used.

DOMPurify, which the sanitizer is based on, removes for on all elements except label and output since version 3.4.

Steps to reproduce

1. Create a page with the following content, as a user without script right:

   {{html}}
   <div for="x">a</div><template for="x"><p>b</p></template><label for="x">c</label>
   {{/html}}
   

Expected: for is kept only on label.
Actual: for is kept on all three elements.