Table of Contents
An HTML Whitelist is a configuration file that defines allowed HTML tags and their attribute names or values. All tags and attributes that are not listed in this file have to be removed to filter dangerous HTML content.
The HTML whitelist is defined in the 'whitelist.properties' configuration file. This file is divided in three sections:
| HTML tags and attributes |
| CSS name/value pairs |
| CSS combi map |
This section includes the allowed HTML tags and attributes. Each entry is preceded by „html.tag.“, followed by the name of the allowed tag. The attributes form a comma-separated, quoted list. The attributes can be followed by their allowed values. The values are put in square brackets and separated by ':'. Example:
html.tag.area=",alt,coords,href,nohref[nohref],shape[:rect:circle:poly:default:],tabindex,target,"
This entry allows the „area“ tag. The attributes are listed within the quoatation marks. The allowed values for the „shape“ attribute are listed within the square brackets. If the attributes list contains empty brackets, only numeric values are allowed:
html.tag.pre=",width[],"
If the attributes list is empty, only the HTML tag without any attributes is allowed:
html.tag.span=""
Analogous to the HTML tags and attributes, this section includes allowed CSS elements with their allowed values. Each entry is preceded by „html.style.“, followed by the name of the CSS element. Allowed values are defined in a comma-separated, quoted list.
For the values it is possible to use wildcards that comprise certain value types:
| c: Any CSS color value |
| u: An URL; e. g. url(http://www.somewhere.com/myimage.jpg); |
| n: Any CSS number value without '%' |
| N: Any CSS number value |
| *: Any value allowed |
| d: delete |
| t: time |
Example:
html.style.background-color="c,transparent,"
This allows the CSS element „background-color“. For this element any CSS clor values and the value „transparent“ are allowed. Wildcards precede the list and are not comma-separated:
="uNc,scroll,fixed,..."
The second section of CSS Name/Value Pairs allows entries with an empty value list:
html.style.border=""
Such entries refer to the CSS combi map i. e., the respective CSS element configuration is included in the CSS combi map:
html.style.combimap.border="Nc,transparent,none,hidden,dotted,dashed,solid,double,groove,ridge,inset,outset,separate,collapse,"
Entries in the combi map are preceded with „html.style.combimap.“, followed by the respective CSS element. Analogous to the latter section, the element is followed by the value listing.