---
title: To Configure Allowed HTML Tags and Attributes
slug: neurons-for-itsm/admin-user-help/enu/latest/to-configure-allowed-html-tags-and-attributes
createdAt: 2026-07-14T19:16:29.417Z
---

**Role**: Administrator

**Minimum Version**: Ivanti Neurons for ITSM 2025.3

You can now enable support for specific HTML tags and attributes, such as **\<object>**, **\<iframe>**&#x69;n HTML type fields across all business objects. Common use cases include embedding advanced HTML formatting or video objects into **Incident**, **Knowledge**, and **Problem** records. This feature allows users to embed custom HTML content safely.

## Background

The ITSM application sanitizes HTML content using the **DOMPurify** library during UI rendering. By default, DOMPurify removes all potentially malicious or unwanted HTML tags and attributes to ensure secure display of user generated content.

Some business scenarios may require specific HTML elements, such as **\<object>**, **\<iframe>**. To support these cases, this feature allows administrators to configure a list of allowed tags and attributes, effectively whitelisting only the required HTML elements for those scenarios.

This feature helps organizations maintain a secure-by-design application and gives administrators control over which HTML content is preserved during sanitization. You can define allowed tags and attributes at the field level to minimize exposure.

**Additional notes on HTML Sanitization behavior**

Currently, you can enable configurable HTML sanitization in the following two areas:

- **Business object fields:** Fields set to type HTML are sanitized to prevent cross-site scripting (XSS) and other security vulnerabilities.
- **Journal emails and journal notes:** When configured as HTML fields, these components are sanitized to ensure secure rendering and proper handling.

:::Paragraph{indent="1"}
Journal notes are currently stored as text fields but render as HTML inside a flex component. This is unintended behavior and introduces a potential security risk. To follow secure practices, administrators must do one of the following:
:::

- **Convert journal notes to HTML fields**: This allows the system to apply proper sanitization and reduce the risk of XSS attacks.

For detailed information on future changes to DOMPurify behavior and global constant defaults, see [Whitelisted HTML Tags and Attributes (DOMPurify)](docId\:A1giYs5FSEoxjjYDzzOJM).

## Blacklisted HTML Attributes

The application permanently blocks the following attributes to protect against cross-site scripting (XSS) and other security vulnerabilities. These blacklisted items are hard-coded and cannot be overridden through configuration.

The following items are blacklisted:

- **Attribute values containing scripting keywords:**
  javascript, jscript, vbscript, expression
- **Event-driven attributes**:
  onclick, ondblclick, onmousedown, onmousemove, onmouseout, onmouseover, onmouseup,
  onkeydown, onkeypress, onkeyup, onabort, onerror, onload, onunload, onresize,
  onscroll, onblur, onchange, onfocus, onreset, onselect, onsubmit, onpointerover

:::hint{type="info"}
These tags and attributes are blacklisted for the current release (2025.4). The product team is still finalizing and the blacklist may change in a future release.
:::

## Whitelisted HTML Tags and Attributes (DOMPurify)

Ivanti Neurons for ITSM uses the DOMPurify library to sanitize HTML input fields and ensure secure rendering of user-generated content. DOMPurify relies on a default whitelist to determine which HTML tags and attributes are permitted.

This topic provides an overview of the default whitelist behavior in DOMPurify version 1.0.8, which is used in release 2025.3 onwards.

**Overview:**

DOMPurify uses an internal whitelist that defines which HTML tags and attributes are considered safe. Any tag or attribute not included in this list is automatically removed during sanitization.

You can define additional tags and attributes using **Allowed Tags/Attributes** configuration.

**Whitelisted HTML Tags and Attributes:**

The following are examples of tags and attributes whitelisted by DOMPurify. This list is not exhaustive and is based on version 1.0.8.

Common HTML Tags (Whitelisted by Default)

\<a>, \<abbr>, \<b>, \<blockquote>, \<br>, \<caption>, \<cite>, \<code>, \<col>, \<colgroup>, \<dd>, \<del>, \<dfn>, \<div>, \<dl>, \<dt>, \<em>, \<h1>–\<h6>, \<hr>, \<i>, \<img>, \<ins>, \<kbd>, \<li>, \<mark>, \<ol>, \<p>, \<pre>, \<q>, \<s>, \<samp>, \<section>, \<small>, \<span>, \<strong>, \<sub>, \<sup>, \<table>, \<tbody>, \<td>, \<tfoot>, \<th>, \<thead>, \<tr>, \<u>, \<ul>, \<var>, \<style>, \<base>, \<xml>, \<script>, \<applet>, \<embed>, \<iframe>

Common HTML Attributes (Whitelisted by Default)

abbr, align, alt, axis, bgcolor, border, cellpadding, cellspacing, char, charoff,

cite, class, clear, cols, colspan, color, compact, coords, datetime, dir, face,

headers, height, href, hreflang, hspace, id, ismap, lang, longdesc, name, nohref,

noshade, nowrap, rel, rev, rows, rowspan, rules, scope, shape, size, span, src,

start, summary, tabindex, target, title, type, valign, value, vspace, width

:::hint{type="info"}
- **data-\*** and **aria-\*** attributes are also whitelisted by default. You can control them using DOMPurify options **ALLOW\_DATA\_ATTR** and **ALLOW\_ARIA\_ATTR**.
- Any tag or attribute not explicitly defined in your configured whitelist (or not supported by DOMPurify) is removed automatically during rendering.
:::

::::ExpandableHeading
## For Incident

The following procedure describes how to configure allowed HTML tags and attributes for the Incident workspace.

- [Create a HTML Tags and Attribute Set.](docId\:A1giYs5FSEoxjjYDzzOJM)
- [Configure the Description Field to Use HTML Viewer.](docId\:A1giYs5FSEoxjjYDzzOJM)
- [Apply Whitelist to an HTML Field.](docId\:A1giYs5FSEoxjjYDzzOJM)
- [Use Configured HTML Tags in the Incident Workspace.](docId\:A1giYs5FSEoxjjYDzzOJM)

## Create a HTML Tags and Attribute Set

1. Go to **Settings** > **Configure** > **Security Controls** > **Allowed Tags/Attributes**.
2. Click **New.**
3. In the **Name** field, enter a descriptive name (for example, Description).
4. In the **Value** field, add the allowed tags and attributes in JSON format:
   `{`
   `"object": ["data", "type", "width", "height"]`
   `}`
5. Click **Save**.

:::hint{type="info"}
Only the tags and attributes in this new set will become unblocked when applied to a field. Any unspecified tags and attributes defined in the default set will continue to be blocked.
:::

## Configure the Description field to Use HTML Viewer

After assigning a tag and attribute whitelist to an HTML field, you must configure how the field is rendered in the form. In this case, the **Description** field within the **Incident** business object is updated to use the HTML Viewer control to correctly display allowed HTML tags.

To configure the field on the form:

1. Navigate to **Build** > **Business Objects** > **Incident** > **Forms**.
2. Open the form named **Incident.PopUp**.
3. In the form layout, select the **Description** field
4. In the **Control Properties** pane on the left, locate the **Control Type** field.
5. From the dropdown list, select **HTML Viewer**.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/IUH2r_IAaMYCHzrvLpusq_description-field-setting-in-incident-pop-up.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Description Field setting in Incident pop-up.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Description Field setting in Incident pop-up.png" showCaption="false" width="1897" height="1003" darkWidth="1897" darkHeight="1003"}
6. Click **Save**.

## Apply Whitelist to an HTML Field

1. Navigate to **Build** > **Business Objects** > **Incident** > **Fields**.
2. Locate and select the desired field (for example, **Symptom**).
3. Set the **Field Type** as **HTML**.
4. In the **Set Name** field, select the appropriate html tag set (for example, Description) from the dropdown.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/NI_E2meoTvrObX-74htV9_business-objectfield-type-and-set-name.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Business Object(Field Type and Set Name).png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Business Object(Field Type and Set Name).png" showCaption="false" width="1891" height="1002" darkWidth="1891" darkHeight="1002"}
5. Click **Save**.

## Use Configured HTML Tags in the Incident Workspace

After configuration is complete, you can add HTML content to the configured field using the **Source Edit** option.

**Add HTML Content to the Description Field**

1. Navigate to the **Home** page.
2. Select **Incident** on the navigation bar to open the **Incident** workspace.
3. Select the appropriate incident record.
4. In the **Description** field, click the double arrow :inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/_ldUoofWXOJHuUfs7byL7_double-arrow-in-the-control-panel-of-description-in-incident36x21.png" alt caption size="10" width="36" height="21"} icon to expand the editor.
5. In the expanded panel, click **Source Edit**.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/A-EkI1KP1lEQDpjGIFscN_source-edit-in-description-in-incident-field.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/source edit in Description in incident field.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/source edit in Description in incident field.png" showCaption="false" width="982" height="435" darkWidth="982" darkHeight="435"}
6. Enter the required HTML code using the allowed tags and attributes.
   `<object width="1590" height="560" title="Client Software" data=https://www.html-seminar.de/ frameborder="0"></object>`
7. Click **Save**.

:::Paragraph{indent="1"}
You can view the configured HTML content in the Description field on the Incident form, rendered according to the assigned tag and attribute settings.
:::

::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/oQyK24tdybPZQPHHvNXl-_configured-html-in-the-description.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Configured HTML in the description.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Configured HTML in the description.png" showCaption="false" width="656" height="325" darkWidth="656" darkHeight="325" indent="1"}

:::hint{type="info"}
Only the HTML tags and attributes that are explicitly configured in the assigned tag set will be retained. Any disallowed tags or attributes will be removed automatically during rendering the **Description** field.
:::
::::

::::ExpandableHeading
## For Knowledge

The following procedure describes how to configure allowed HTML tags and attributes for the Knowledge workspace.

- [Create a HTML Tags and Attribute Set](docId\:A1giYs5FSEoxjjYDzzOJM).
- [Configure the Answer field to Use HTML Viewer](docId\:A1giYs5FSEoxjjYDzzOJM).
- [Apply Whitelist to an HTML Field](docId\:A1giYs5FSEoxjjYDzzOJM).
- [Use Configured HTML Tags in the Knowledge Workspace](docId\:A1giYs5FSEoxjjYDzzOJM).

## Create a HTML Tags and Attribute Set

1. Go to **Settings** > **Configure** > **Security Controls** > **Allowed Tags/Attributes**.
2. Click **New.**
3. In the **Name** field, enter a descriptive name (for example, Description).
4. In the **Value** field, add the allowed tags and attributes in JSON format:
   `{`
   `"object": ["data", "type", "width", "height"]`
   `}`
5. Click **Save**.

:::hint{type="info"}
Only the tags and attributes in this new set will become unblocked when applied to a field. Any unspecified tags and attributes defined in the default set will continue to be blocked.
:::

## Configure the Answer field to Use HTML Viewer

After assigning a tag and attribute whitelist to an HTML field, you must configure how the field is rendered in the form. In this case, the **Answer** field within the **Knowledge** business object is updated to use the HTML Viewer control to correctly display allowed HTML tags.

To configure the field on the form:

1. Navigate to **Build** > **Business Objects** > **Business Object FRS\_Knowledge#QandA** > **Forms**.
2. Open the form named Form **FRS\_Knowledge.QandA.ArticleView**.
3. In the form layout, select the **Answer** field
4. In the **Control Properties** pane on the left, locate the **Control Type** field.
5. From the dropdown list, select **HTML Viewer**.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/ENI9cGBeUFMTJQsptomGw_knowledgeforms-business-objects.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Knowledge_Forms_ Business Objects.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Knowledge_Forms_ Business Objects.png" showCaption="false" width="1807" height="930" darkWidth="1807" darkHeight="930"}
6. Click **Save**.

## Apply Whitelist to an HTML Field

1. Navigate to **Build** > **Business Objects** > **Business Object FRS\_Knowledge#QandA** > **Fields**.
2. Locate and select the desired field (for example Field Name, **Resolution**).
3. Set the **Field Type** as **HTML**.
4. In the **Set Name** field, select the appropriate html tag set (for example, **Description**) from the dropdown.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/bdAeTxVR9NOoNM_t4TXiK_knoiwledgefieldbusiness-objects.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Knoiwledge_Field_Business Objects.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Knoiwledge_Field_Business Objects.png" showCaption="false" width="1910" height="952" darkWidth="1910" darkHeight="952"}
5. Click **Save**.

## Use Configured HTML Tags in the Knowledge Workspace

After configuration is complete, you can add HTML content to the configured field using the **Source Edit** option.

**Add HTML Content to the Answer Field**

1. Navigate to the **Home** page.
2. Select **Knowledge** on the navigation bar to open the **Knowledge** workspace.
3. Select the appropriate record.
4. In the **Answer** field, click the double arrow :inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/_ldUoofWXOJHuUfs7byL7_double-arrow-in-the-control-panel-of-description-in-incident36x21.png" alt caption size="10" width="36" height="21"} icon to expand the editor.
5. In the expanded panel, click **Source Edit**.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/M7FxXL8KisPr3tEM5G11O_knowledge-answersourceedit.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Knowledge Answer_SourceEdit.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Knowledge Answer_SourceEdit.png" showCaption="false" width="1907" height="917" darkWidth="1907" darkHeight="917"}
6. Enter the required HTML code using the allowed tags and attributes.
   `<object width="1590" height="560" title="Client Software" data=https://www.html-seminar.de/ frameborder="0"></object>`
7. Click **Save**.

:::Paragraph{indent="1"}
You can view the configured HTML content in the Description field on the Incident form, rendered according to the assigned tag and attribute settings.
:::

::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/Tnu-OLgwwkL9c8gvBxd4R_knowledgehtmlviweranswer.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Knowledge_HTML_Viwer_Answer.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Knowledge_HTML_Viwer_Answer.png" showCaption="false" width="1787" height="727" darkWidth="1787" darkHeight="727" indent="1"}

:::hint{type="info"}
Only the HTML tags and attributes that are explicitly configured in the assigned tag set will be retained. Any disallowed tags or attributes will be removed automatically during rendering the **Answer** field.
:::
::::

::::ExpandableHeading
## For Problem

The following procedure describes how to configure allowed HTML tags and attributes for the Problem workspace.

- [Create a HTML Tags and Attribute Set](docId\:A1giYs5FSEoxjjYDzzOJM).
- [Configure the Description field to Use HTML Viewer](docId\:A1giYs5FSEoxjjYDzzOJM).
- [Apply Whitelist to an HTML Field](docId\:A1giYs5FSEoxjjYDzzOJM).
- [Use Configured HTML Tags in the Problem Workspace](docId\:A1giYs5FSEoxjjYDzzOJM).

## Create a HTML Tags and Attribute Set

1. Go to **Settings** > **Configure** > **Security Controls** > **Allowed Tags/Attributes**.
2. Click **New.**
3. In the **Name** field, enter a descriptive name (for example, Description).
4. In the **Value** field, add the allowed tags and attributes in JSON format:
   `{`
   `"object": ["data", "type", "width", "height"]`
   `}`
5. Click **Save**.

:::hint{type="info"}
Only the tags and attributes in this new set will become unblocked when applied to a field. Any unspecified tags and attributes defined in the default set will continue to be blocked.
:::

## Configure the Description field to Use HTML Viewer

After assigning a tag and attribute whitelist to an HTML field, you must configure how the field is rendered in the form. In this case, the **Answer** field within the **Knowledge** business object is updated to use the HTML Viewer control to correctly display allowed HTML tags.

To configure the field on the form:

1. Navigate to **Build** > **Business Objects** > **Business Object Problem** > **Forms**.
2. Open the form named Form **Problem.PopUp**.
3. In the form layout, select the **Description** field
4. In the **Control Properties** pane on the left, locate the **Control Type** field.
5. From the dropdown list, select **HTML Viewer**.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/WqRQ8fjFZooORw5lLFeZH_problembusiness-objectsdescription.png" position="flex-start" size="40" initialPath="../../Resources/Images/SelfServiceMgmt-images/Problem_Business Objects_Description.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Problem_Business Objects_Description.png" showCaption="false" width="1807" height="922" darkWidth="1807" darkHeight="922"}
6. Click **Save**.

## Apply Whitelist to an HTML Field

1. Navigate to **Build** > **Business Objects** > **Business Object Problem** > **Fields**.
2. Locate and select the desired field (for example Field Name, **Description**).
3. Set the **Field Type** as **HTML**.
4. In the **Set Name** field, select the appropriate html tag set (for example, **Description**) from the dropdown.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/4AWU_l0-EvyaHdS9Ye5PB_problembusiness-objectsfield.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Problem_Business Objects_Field.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Problem_Business Objects_Field.png" showCaption="false" width="1905" height="922" darkWidth="1905" darkHeight="922"}
5. Click **Save**.

## Use Configured HTML Tags in the Problem Workspace

After configuration is complete, you can add HTML content to the configured field using the **Source Edit** option.

**Add HTML Content to the Answer Field**

1. Navigate to the **Home** page.
2. Select **Problem** on the navigation bar to open the **Problem** workspace.
3. Select the appropriate record.
4. In the **Description** field, click the double arrow :inlineImage[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/_ldUoofWXOJHuUfs7byL7_double-arrow-in-the-control-panel-of-description-in-incident36x21.png" alt caption size="10" width="36" height="21"} icon to expand the editor.
5. In the expanded panel, click **Source Edit**.

   ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/PKpzf1YmWhyA4N4UcTWma_problemdescriptionfieldsource-edit.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Problem_Description_Field_Source Edit.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Problem_Description_Field_Source Edit.png" showCaption="false" width="1855" height="903" darkWidth="1855" darkHeight="903"}
6. Enter the required HTML code using the allowed tags and attributes.
   \<object width="1590" height="560" title="Client Software" data=https\://www\.html-seminar.de/ frameborder="0">\</object>
7. Click **Save**.

:::Paragraph{indent="1"}
You can view the configured HTML content in the Description field on the Incident form, rendered according to the assigned tag and attribute settings.
:::

::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/w4f-JnRzPlWSEy2gvZLFG_problemsource-edithtml.png" position="flex-start" size="80" initialPath="../../Resources/Images/SelfServiceMgmt-images/Problem_Source EDIT_HTML.png" githubPath="Content/Resources/Images/SelfServiceMgmt-images/Problem_Source EDIT_HTML.png" showCaption="false" width="1852" height="915" darkWidth="1852" darkHeight="915" indent="1"}

:::hint{type="info"}
Only the HTML tags and attributes that are explicitly configured in the assigned tag set will be retained. Any disallowed tags or attributes will be removed automatically during rendering the **Description** field.
:::
::::