Using HTML in descriptions
3 minute read
Most description fields in Cloud Management Platform (CMP) accept simple HTML without any configuration. To display more advanced HTML, such as style tags or attributes, you have to override one or more settings in customer_settings.py.
CMP sanitizes user-supplied HTML with the Python library bleach, using its clean method. Four settings control what survives sanitizing. Three of them map directly to keyword arguments of bleach.clean; the fourth configures bleach’s CSS sanitizer.
Import a setting before changing part of it. customer_settings.py is loaded as a module of its own, so a line that edits an entry of a setting the file has not imported raises an error and CMP does not start. Replacing a setting outright needs no import.
Default values
The defaults for tags, attributes, and protocols are taken largely from bleach with a few additions, and are safe enough for most uses. The default for styles is different: it is empty, so no inline CSS survives until you add some.
To examine the current value of a setting, look at the CMP-defined settings.py (/opt/cloudbolt/settings.py by default) and the customer-defined overrides in customer_settings.py (/var/opt/cloudbolt/proserv/customer_settings.py by default), or read it from Shell Plus:
from django.conf import settings
settings.BLEACH_ALLOWED_TAGS
BLEACH_ALLOWED_TAGS
A list, corresponding to the bleach.clean keyword argument tags.
To add tags to the defaults, add lines like these to customer_settings.py:
from settings import BLEACH_ALLOWED_TAGS
BLEACH_ALLOWED_TAGS += ["style"]
To replace the defaults with your own list instead, use a line like this:
BLEACH_ALLOWED_TAGS = ["a", "b"]
BLEACH_ALLOWED_ATTRS
A dict, corresponding to the bleach.clean keyword argument attributes. Its keys are HTML tags and its values are lists of the attributes allowed on each tag.
The * key sets which attributes are allowed on tags that are not named explicitly in the dict. Its value defaults to another CMP setting, BLEACH_DEFAULT_ALLOWED_ATTRS, which is a list you can override like any other.
To add attributes to a tag already in the dict:
from settings import BLEACH_ALLOWED_ATTRS
BLEACH_ALLOWED_ATTRS["a"] += ["target", "rel"]
To add a tag, or replace the attributes allowed on one:
from settings import BLEACH_ALLOWED_ATTRS
BLEACH_ALLOWED_ATTRS["a"] = ["title"]
To remove a tag’s entry entirely:
from settings import BLEACH_ALLOWED_ATTRS
del BLEACH_ALLOWED_ATTRS["a"]
BLEACH_ALLOWED_STYLES
A list of the CSS properties allowed inside a style attribute. CMP passes it to bleach’s CSS sanitizer as allowed_css_properties, rather than to bleach.clean directly.
Unlike the other three settings, this one is empty by default, so no inline CSS property survives sanitizing until you list it here. Allowing the style attribute on a tag through BLEACH_ALLOWED_ATTRS is not enough on its own: you need both.
For example, to allow color to be set in the style attribute of an a tag, add these lines to customer_settings.py:
from settings import BLEACH_ALLOWED_ATTRS
# Allow the style attribute on the 'a' tag ...
BLEACH_ALLOWED_ATTRS["a"] += ["style"]
# ... and allow these properties inside it.
BLEACH_ALLOWED_STYLES = ["color", "background-color"]
BLEACH_ALLOWED_PROTOCOLS
A list, corresponding to the bleach.clean keyword argument protocols. It controls which protocols may be used in tags that point at other web addresses, such as the href of an a tag or the src of an img tag.
To allow HTTPS only, add the following line to customer_settings.py:
BLEACH_ALLOWED_PROTOCOLS = ["https"]