You must modify a script include to make configuration changes to the HTML sanitizer.

Before you begin

Role required: admin

Procedure

  1. Navigate to All > System Definition > Script Includes.
  2. Open HTMLSanitizerConfig.
  3. To add items to the exclusion list, use the HTML_BLACKLIST class.

    To add items to the inclusion list, use the HTML_WHITELIST class.

    Use this format:

    HTML_XXXXLIST :{
        globalAttributes :{ 
 
            attribute:[attribute-name1,...],
            attributeValuePattern:{ attribute-name2:attribute-value-regex-pattern,...}
 
        },<html-element-name>:{// Same as Above},----}
    • globalAttributes contains attribute or attributeValuePattern items that are applicable globally for all the HTML elements.
    • attribute is a comma-separated list of attributes.
    • attributeValuePattern is a dictionary of attribute to attribute-value-regex-pattern pairs. The attribute-value-regex-pattern is a regular expression which has to match the attribute value.

Example

Consider the following example:

HTML_WHITELIST:{
        globalAttributes:{
            attribute:["id","name"],},
        img:{
            attribute:["style","align"],
            attributeValuePattern:{src:".*jpeg"}}, 
        iframe:{},}

It adds the following items to the inclusion list:

  • The global attributes id and name. This is a list of strings that can be applied globally to all the elements.
  • The img element where the attributes are style and align.
  • The img element where the source attribute of the image is a file with the .jpeg extension. This is an example of a regular expression pattern that matches an attribute value.
  • The iframe element.