XSS - OWASP HTML Sanitizer Filters <form>
<p>I'm using the <a href="https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project" rel="nofollow">Java OWASP HTML Sanitizer</a> (<a href="https://owasp-java-html-sanitizer.googlecode.com/svn-history/r28/trunk/distrib/javadoc/org/owasp/html/HtmlPolicyBuilder.html" rel="nofollow"><code>HtmlPolicyBuilder</code></a>) to clean HTML being rendered in my web app, provided by 3rd party services.</p>

<p>Using some of the out of the box options, I notice that <code>&lt;form&gt;</code> tags are removed. I understand that I can include them with <code>allowElements("form")</code>, but is there a good reason to not allow forms?</p>

<p>What sort of XSS attacks should I be thinking about when rendering <em>others'</em> forms on my website?</p>

<hr>

<p>For reference, my sanitization policy is:</p>

<pre><code>new HtmlPolicyBuilder()
    .allowCommonBlockElements()
    .allowCommonInlineFormattingElements()
    .allowStyling()
    .allowStandardUrlProtocols()
    .toFactory()
</code></pre>