# Using HTML in descriptions

> Allow richer HTML in description fields by overriding the sanitizer settings

---

Site [llms.txt](/llms.txt)

---

Most description fields in Cloud Management Platform (CMP) accept simple HTML without any configuration. To display more advanced HTML, such as style tags or attributes, you have to override one or more settings in `customer_settings.py`.

CMP sanitizes user-supplied HTML with the Python library `bleach`, using its [clean](https://bleach.readthedocs.io/en/latest/clean.html) method. Four settings control what survives sanitizing. Three of them map directly to keyword arguments of `bleach.clean`; the fourth configures bleach's CSS sanitizer.

<div class="alert alert-warning" role="alert">


Import a setting before changing part of it. `customer_settings.py` is loaded as a module of its own, so a line that edits an entry of a setting the file has not imported raises an error and CMP does not start. Replacing a setting outright needs no import.
</div>


## Default values

The defaults for tags, attributes, and protocols are taken largely from `bleach` with a few additions, and are safe enough for most uses. The default for styles is different: it is empty, so no inline CSS survives until you add some.

To examine the current value of a setting, look at the CMP-defined `settings.py` (`/opt/cloudbolt/settings.py` by default) and the customer-defined overrides in `customer_settings.py` (`/var/opt/cloudbolt/proserv/customer_settings.py` by default), or read it from [Shell Plus](/docs/cmp/developer-resources/guide/shell-plus/):

```python
from django.conf import settings
settings.BLEACH_ALLOWED_TAGS
```

## BLEACH_ALLOWED_TAGS

A list, corresponding to the `bleach.clean` keyword argument [tags](https://bleach.readthedocs.io/en/latest/clean.html#allowed-tags-tags).

To add tags to the defaults, add lines like these to `customer_settings.py`:

```python
from settings import BLEACH_ALLOWED_TAGS
BLEACH_ALLOWED_TAGS += ["style"]
```

To replace the defaults with your own list instead, use a line like this:

```python
BLEACH_ALLOWED_TAGS = ["a", "b"]
```

## BLEACH_ALLOWED_ATTRS

A `dict`, corresponding to the `bleach.clean` keyword argument [attributes](https://bleach.readthedocs.io/en/latest/clean.html#allowed-attributes-attributes). Its keys are HTML tags and its values are lists of the attributes allowed on each tag.

The `*` key sets which attributes are allowed on tags that are not named explicitly in the dict. Its value defaults to another CMP setting, `BLEACH_DEFAULT_ALLOWED_ATTRS`, which is a list you can override like any other.

To add attributes to a tag already in the dict:

```python
from settings import BLEACH_ALLOWED_ATTRS
BLEACH_ALLOWED_ATTRS["a"] += ["target", "rel"]
```

To add a tag, or replace the attributes allowed on one:

```python
from settings import BLEACH_ALLOWED_ATTRS
BLEACH_ALLOWED_ATTRS["a"] = ["title"]
```

To remove a tag's entry entirely:

```python
from settings import BLEACH_ALLOWED_ATTRS
del BLEACH_ALLOWED_ATTRS["a"]
```

## BLEACH_ALLOWED_STYLES

A list of the CSS properties allowed inside a `style` attribute. CMP passes it to bleach's CSS sanitizer as `allowed_css_properties`, rather than to `bleach.clean` directly.

<div class="alert alert-info" role="alert">


Unlike the other three settings, this one is empty by default, so no inline CSS property survives sanitizing until you list it here. Allowing the `style` attribute on a tag through `BLEACH_ALLOWED_ATTRS` is not enough on its own: you need both.
</div>


For example, to allow color to be set in the style attribute of an `a` tag, add these lines to `customer_settings.py`:

```python
from settings import BLEACH_ALLOWED_ATTRS

# Allow the style attribute on the 'a' tag ...
BLEACH_ALLOWED_ATTRS["a"] += ["style"]

# ... and allow these properties inside it.
BLEACH_ALLOWED_STYLES = ["color", "background-color"]
```

## BLEACH_ALLOWED_PROTOCOLS

A list, corresponding to the `bleach.clean` keyword argument [protocols](https://bleach.readthedocs.io/en/latest/clean.html#allowed-protocols-protocols). It controls which protocols may be used in tags that point at other web addresses, such as the `href` of an `a` tag or the `src` of an `img` tag.

To allow HTTPS only, add the following line to `customer_settings.py`:

```python
BLEACH_ALLOWED_PROTOCOLS = ["https"]
```