Allowlist per il codice nei modelli .html

Per questioni di sicurezza e compatibilità, il modello di report .html viene sanificato automaticamente, se necessario, durante il salvataggio. Se il modello contiene tag non consentiti, l'utente riceve una notifica e può scegliere se consentire la rimozione automatica o se rimuoverli manualmente.

Un modello .html non può essere salvato se contiene contenuti non elencati in questa pagina. Quando nel modello sono presenti contenuti vietati, è necessario per prima cosa sanificare i contenuti, automaticamente o rimuovendo manualmente il codice non conforme, prima di effettuare il salvataggio.

Tag consentiti per impostazione predefinita

a, abbr, acronym, address, area, article, aside, b, bdi, big, blockquote, body, br, button, caption, center, cite, code, col, colgroup, data, datalist, dd, del, details, dfn, dir, div, dl, dt, em, fieldset, figcaption, figure, font, footer, form, h1, h2, h3, h4, h5, h6, head, header, hr, html, i, img, input, ins, kbd, keygen, label, legend, li, main, mappare, mark, menu, menuitem, meter, nav, ol, optgroup, option, output, p, pre, progress, q, rp, rt, ruby, s, samp, sezione, select, small, span, strike, strong, style, sub, summary, sup, table, tbody, td, textarea, tfoot, th, thead, time, title, tr, tt, u, ul, var, wbr.

Attributi consentiti per impostazione predefinita

abbr, accept-charset, accept, accesskey, action, align, alt, autocomplete, autosave, axis, bgcolor, border, cellpadding, cellspacing, challenge, char, charoff, charset, checked, cite, class, cancella, color, cols, colspan, compact, contenteditable, coords, datetime, dir, disabled, draggable, dropzone, enctype, for, frame, headers, height, high, href, hreflang, hspace, ismap, keytype, label, lang, list, longdesc, low, max, maxlength, media, method, min, multiple, name, nohref, noshade, novalidate, nowrap, open, optimum, pattern, placeholder, prompt, pubdate, radiogroup, readonly, rel, required, rev, reversed, rows, rowspan, rules, scope, selected, shape, size, span, spellcheck, src, start, step, style, summary, tabindex, target, title, type, usemap, valign, value, vspace, width, wrap.

Proprietà CSS consentite per impostazione predefinita

align-content, align-items, align-self, all, animation, animation-delay, animation-direction, animation-duration, animation-fill-mode, animation-iteration-count, animation-name, animation-play-state, animation-timing-function, backface-visibility, background, background-attachment, background-blend-mode, background-clip, background-color, background-image, background-origin, background-position, background-position-x, background-position-y, background-repeat, background-repeat-x, background-repeat-y, background-size, border, border-bottom, border-bottom-color, border-bottom-left-radius, border-bottom-right-radius, border-bottom-style, border-bottom-width, border-collapse, border-color, border-image, border-image-outset, border-image-repeat, border-image-slice, border-image-source, border-image-width, border-left, border-left-color, border-left-style, border-left-width, border-radius, border-right, border-right-color, border-right-style, border-right-width, border-spacing, border-style, border-top, border-top-color, border-top-left-radius, border-top-right-radius, border-top-style, border-top-width, border-width, bottom, box-decoration-break, box-shadow, box-sizing, break-after, break-before, break-inside, caption-side, caret-color, cancella, clip, color, column-count, column-fill, column-gap, column-rule, column-rule-color, column-rule-style, column-rule-width, column-span, column-width, columns, content, counter-increment, counter-reset, cursor, direction, display, empty-cells, filter, flex, flex-basis, flex-direction, flex-flow, flex-grow, flex-shrink, flex-wrap, float, font, font-family, font-feature-settings, font-kerning, font-language-override, font-size, font-size-adjust, font-stretch, font-style, font-synthesis, font-variant, font-variant-alternates, font-variant-caps, font-variant-east-asian, font-variant-ligatures, font-variant-numeric, font-variant-position, font-weight, gap, griglia, grid-area, grid-auto-columns, grid-auto-flow, grid-auto-rows, grid-column, grid-column-end, grid-column-gap, grid-column-start, grid-gap, grid-row, grid-row-end, grid-row-gap, grid-row-start, grid-template, grid-template-areas, grid-template-columns, grid-template-rows, hanging-punctuation, height, hyphens, image-rendering, isolation, justify-content, left, letter-spacing, line-break, line-height, list-style, list-style-image, list-style-position, list-style-type, margin, margin-bottom, margin-left, margin-right, margin-top, mask, mask-clip, mask-composite, mask-image, mask-mode, mask-origin, mask-position, mask-repeat, mask-size, mask-type, max-height, max-width, min-height, min-width, mix-blend-mode, object-fit, object-position, opacity, order, orphans, outline, outline-color, outline-offset, outline-style, outline-width, overflow, overflow-wrap, overflow-x, overflow-y, padding, padding-bottom, padding-left, padding-right, padding-top, page-break-after, page-break-before, page-break-inside, perspective, perspective-origin, pointer-events, position, quotes, resize, right, row-gap, scroll-behavior, tab-size, table-layout, text-align, text-align-last, text-combine-upright, text-decoration, text-decoration-color, text-decoration-line, text-decoration-skip, text-decoration-style, text-indent, text-justify, text-orientation, text-overflow, text-shadow, text-transform, text-underline-position, top, transform, transform-origin, transform-style, transition, transition-delay, transition-duration, transition-property, transition-timing-function, unicode-bidi, user-select, vertical-align, visibility, white-space, widows, width, word-break, word-spacing, word-wrap, writing-mode, z-index.

Proprietà CSS CSS in base alle regole consentite per impostazione predefinita

namespace, style.

Schemi URI consentiti per impostazione predefinita

data, http, https, mailto.

Attributi predefiniti che contengono URI

action, background, dynsrc, href, lowsrc, src.

.html e commenti CSS

Per comodità degli sviluppatori, i commenti .html sono consentiti nei modelli .html. Tuttavia, vengono rimossi nei report .html generati.

I commenti CSS vengono rimossi sia nei modelli .html che nei report .html generati.

Esempio di sanificazione

Il seguente codice .html richiede una sanificazione perché contiene un elemento script. Il tag script non è incluso in Tag consentiti per impostazione predefinita.

<html><head>
  <style>h2 { color: red }</style>
  <script>Window.alert('Hi!')</script>
  <title>Sanitization example</title>
  </head>
  <body>
    <h2>This is your chart</h2>
    
</body></html>

Quando si aggiunge il codice e si prova a salvare il modello, viene richiesto di eseguire una delle seguenti operazioni:

• Consentire la sanificazione automatica del codice facendo clic su Salva comunque.

• Tornare all'editor per correggere il codice da soli, facendo clic su Chiudi e continua la modifica.

Con la sanificazione automatica, il codice risultante nel modello sarà il seguente:

<html><head>
  <style>h2 { color: #FF0000 }</style>
  
  <title>Sanitization example</title>
  </head>
  <body>
    <h2>This is your chart</h2>
    
</body></html>