---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Configuring HTML sanitizer

# Configuring HTML sanitizer {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

You must modify a script include to make configuration changes to the HTML
sanitizer.

## Before you begin

Role required: admin

## Procedure

1. Navigate to AllSystem DefinitionScript Includes.
2. Open HTMLSanitizerConfig.
3. To add items to the exclusion list, use the HTML_BLACKLIST class.  
   To add items to the inclusion list, use the HTML_WHITELIST class.

   Use this format:  

       HTML_XXXXLIST :{
               globalAttributes :{ 
        
                   attribute:[attribute-name1,...],
                   attributeValuePattern:{ attribute-name2:attribute-value-regex-pattern,...}
        
               },<html-element-name>:{// Same as Above},----}

   * globalAttributes contains attribute or attributeValuePattern items that are applicable globally for all the HTML elements.
   * attribute is a comma-separated list of attributes.
   * attributeValuePattern is a dictionary of attribute to attribute-value-regex-pattern pairs. The attribute-value-regex-pattern is a regular expression which has to match the attribute value.
   {#t_ConfigureHTMLSanitizer__ul_gvb_ft4_4q}

## Example

Consider the following example:  

    HTML_WHITELIST:{
            globalAttributes:{
                attribute:["id","name"],},
            img:{
                attribute:["style","align"],
                attributeValuePattern:{src:".*jpeg"}}, 
            iframe:{},}

It adds the following items to the inclusion list:

* The global attributes id and name. This is a list of strings that can be applied globally to all the elements.
* The img element where the attributes are style and align.
* The img element where the source attribute of the image is a file with the .jpeg extension. This is an example of a regular expression pattern that matches an attribute value.
* The iframe element.
{#t_ConfigureHTMLSanitizer__ul_igy_k54_4q}

*[\>]: and then