{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41896,"path":"platform-security/t_ConfigureHTMLSanitizer.md","title":"Configuring HTML sanitizer","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configuring HTML sanitizer\n\nYou must modify a script include to make configuration changes to the HTML sanitizer.\n\n## Before you begin\n\nRole required: admin\n\n## Procedure\n\n1.  Navigate to **All** &gt; **System Definition** &gt; **Script Includes**.\n\n2.  Open **HTMLSanitizerConfig**.\n\n3.  To add items to the exclusion list, use the HTML\\_BLACKLIST class.\n\n    To add items to the inclusion list, use the HTML\\_WHITELIST class.\n\n    Use this format:\n\n    ```\n    HTML_XXXXLIST :{\n            globalAttributes :{ \n     \n                attribute:[attribute-name1,...],\n                attributeValuePattern:{ attribute-name2:attribute-value-regex-pattern,...}\n     \n            },<html-element-name>:{// Same as Above},----}\n    ```\n\n    -   **globalAttributes** contains attribute or attributeValuePattern items that are applicable globally for all the HTML elements.\n    -   **attribute** is a comma-separated list of attributes.\n    -   **attributeValuePattern** is a dictionary of attribute to attribute-value-regex-pattern pairs. The attribute-value-regex-pattern is a regular expression which has to match the attribute value.\n\n## Example\n\nConsider the following example:\n\n```\nHTML_WHITELIST:{\n        globalAttributes:{\n            attribute:[\"id\",\"name\"],},\n        img:{\n            attribute:[\"style\",\"align\"],\n            attributeValuePattern:{src:\".*jpeg\"}}, \n        iframe:{},}\n```\n\nIt adds the following items to the inclusion list:\n\n-   The global attributes id and name. This is a list of strings that can be applied globally to all the elements.\n-   The img element where the attributes are style and align.\n-   The img element where the source attribute of the image is a file with the .jpeg extension. This is an example of a regular expression pattern that matches an attribute value.\n-   The iframe element.\n\n"}}