Enable HTML Editor whitelist

The HTML Editor enables users to visually add and edit rich text content formatted with HTML tags. Though the HTML Editor is powerful, web sites may be abused without a proper security control. Therefore, as of Service Manager 9.41, you can use the HTML Editor whitelist to define a list of allowed HTML elements.

To enable the HTML Editor whitelist and define a list of allowed HTML elements, follow these steps:

  1. Log on to Service Manager as a system administrator.
  2. Click Tailoring > Whitelist > HTML Editor Whitelist.
  3. Select the Enable HTML Editor Whitelist check box. By default, this check box is checked.
  4. Define a list of allowed HTML Tags and attributes in the Allowed Tags/Attributes section. For example, add script as an allowed tag so that you are able to input the <script> tag by using the HTML Editor.
  5. Define a list of allowed URL protocols for some elements in the Allowed URL Protocols section. For example, add a as an allowed tag, specify href as the attribute, and then specify one or more protocols that are used by the href attribute, such as http, https, mailto and ftp.

  6. Click Save and OK.
  7. Do either of the following to make the customized HTML Editor whitelist effective:

    • Restart the web application server if you are working with the Service Manager web client.
    • Log out and then log on to the Service Manager Windows client again.

After the HTML Editor whitelist became effective, you are only allowed to input the elements as listed in the whitelist when editing HTML contents using the HTML Editor. The system automatically validates your inputs and displays some warning messages if there are tags, attributes or protocols that violate the whitelist. For example:

The HTML document contains some tags <script>,<javascript> that are not allowed by the system. Contact your Service Manager system administrator for assistance.

The HTML document contains some attributes for tags (<tag attribute...>) <div onlick>,<p onerror> that are not allowed by the system. Contact your Service Manager system administrator for assistance.

The HTML document contains some values in the attributes of tags (<tag attribute>) <img src>,<a href> that are not allowed by the system. Contact your Service Manager system administrator for assistance.

You must review your input and avoid using these invalid tags, attributes, or protocols. Alternatively, you can ask your Service Manager system administrator to include these tags, attributes or protocols to the whitelist. Otherwise, the system automatically removes these invalid elements from your input after you click Save in the HTML editor.

Caution Service Manager 9.41 introduces the HTML Editor whitelist solution and provides a default whitelist for tags, attributes or protocols that are allowed in Service Manager out-of-box knowledge documents. We recommend that you enable this enhancement. However, your HTML documents may contain tags, attributes, or protocols that are not defined in the whitelist before the 9.41 release. We recommend that the Service Manager system administrators perform extensive tests in the development environment and add all necessary tags, attributes, or protocols to the whitelist before enabling the HTML Editor whitelist. Otherwise, enabling the HTML Editor whitelist without prior tests may cause data loss to the existing knowledge documents in the production environment.

Related concepts

Creating and editing forms
Using the drawing canvas
Enabling HTML in forms
Using the HTML Editor
Using pop-ups
Forms Designer best practices
Web client forms

Related tasks

Access Forms Designer
Create a form using the Form Wizard
Update a form
Add a dynamic form to a form
Add a pop-up to a form
Add a subform to a form

Related references

HTML Editor control
HTML Viewer control
Forms Designer controls and tools
HTML Editor controls
HTML Editor keyboard shortcuts