Summary

Use of HTML is allowed in several areas of the system including in the design of casebook questions to allow users more freedom in formatting text and data. To prevent vulnerabilities the HTML allowed is limited to the whitelisted codes outlined below.

***************************************
* Question text and Question help text:
***************************************
- allowed html elements: "a", "b", "big", "blockquote", "br", "caption", "col", "colgroup", "dd", "del", "div", "dl", "dt", "font", "h1", "h2", "h3", "hr", "i", "img", "li", "ol", "p", "small", "span", "strong", "sub", "sup", "table", "tbody", "td", "tfoot", "th", "thead", "tr", "u", "ul"

- allowed html attributes:
  - for element "a" we allow attributes "href", "target", "rel"
  - for element "b" we allow attribute "style"
  - for element "col" we allow attribute "style"
  - for element "div" we allow attributes "style", "align"
  - for element "font" we allow attribute "color", "size", "face"
  - for element "h1" we allow attribute "align"
  - for element "h2" we allow attribute "align"
  - for element "h3" we allow attribute "align"
  - for element "img" we allow attributes "align", "src", "alt", "width", "height"
  - for element "ol" we allow attributes "style", "type", "start"
  - for element "p" we allow attribute "style", "align"
  - for element "span" we allow attribute "style"
  - for element "table" we allow attributes "align", "border", "style", "cellpadding", "width"
  - for element "td" we allow attributes "style", "align", "valign", "rowspan", "width", "nowrap", "colspan"
  - for element "th" we allow attributes "style", "align", "valign", "rowspan", "width", "nowrap", "colspan"
  - for element "tr" we allow attributes "style", "align", "valign"
  - for element "ul" we allow attributes "style", "type"
- allowed protocols:
  - for element "a" and attribute "href" we allow protocols "http", "https", "mailto"
  - for element "img" and attribute "src" we allow protocols "http", "https"


***********************
* Question choice text:
***********************
- allowed html elements: "br", "b", "span", "i", "font", "u", "sup", "sub", "hr", "a", "small"

- allowed html attributes:
  - for element "a" we allow attributes "href", "target", "rel"
  - for element "b" we allow attribute "style"
  - for element "font" we allow attribute "color", "size", "face"
  - for element "span" we allow attribute "style"

- allowed protocols:
  - for element "a" and attribute "href" we allow protocols "http", "https", "mailto"
  - for element "img" and attribute "src" we allow protocols "http", "https"



**********************
* Question alert text:
**********************
- allowed html elements: "b", "br", "font", "hr" "i", "span", "sub", "sup", "u"

- allowed html attributes:
  - for element "b" we allow attribute "style"
  - for element "font" we allow attribute "color", "size", "face"
  - for element "span" we allow attribute "style"

****************
*Style handling:
****************
Everywhere that the style attribute is allowed, we restrict the usable style properties: "background-color", "border", "border-bottom", "border-collapse", "border-left", "border-right", "border-top", "border-width", "color", "font-size", "font-weight", "list-style", "list-style-type", "margin", "margin-bottom", "margin-left", "margin-right", "margin-top", "padding", "padding-bottom", "padding-left", "padding-right", "padding-top", "text-align", "text-decoration", "text-indent", "width"

Be aware that we do not allow all valid html style property values. Selected options, (especially for composite values) might not be allowed.