---
name: "HTMLDocument.WhiteList"
section: "3kaya"
platform: "linux"
package: "kaya"
version: "0.4.4-6.2"
release: "Debian 8 (Jessie)"
platforms: ["linux"]
url: "https://new.carta.tech/HTMLDocument.WhiteList"
---

# HTMLDocument.WhiteList(3kaya)

Elements to allow in String-\>HTML conversion

## NAME

HTMLDocument::WhiteList - Elements to allow in String-\>HTML conversion

## SYNOPSIS

**HTMLDocument::WhiteList\<** **\>**

-

  \=  **UltraSafe(****)**

-

  \|  **InlineOnly(***HTMLDocument::ConversionSafety sa***)**

-

  \|  **AllElements(***HTMLDocument::ConversionSafety sb***)**

-

  \|  **Unchecked(****)**

-

  \|  **CustomWhitelist(***Dict::Dict\<String, \[String\]\>  whitelist***)**

## DESCRIPTION

When converting from a String to HTML, rather than simply adding a String to an existing element where it will be escaped, the elements allowed in the conversion should depend on how trustworthy the String is. Generally, any unauthenticated user-supplied data should be treated extremely cautiously, and even authenticated user-supplied data should be treated with some caution in case the authentication is broken.

Use of String to HTML conversion allows potential for cross-site scripting attacks ⟨http://www.cert.org/archive/pdf/cross\_site\_scripting.pdf⟩ against your application, especially if the allowed element list is generous.

-

  \-  **UltraSafe**  - removes all tags and attributes. This differs from adding the string directly as text, which escapes them. This conversion method is immune to cross-site scripting.

-

  \-  **InlineOnly**  - allows only inline elements.

-

  \-  **AllElements**  - allows inline and block elements.

-

  \-  **Unchecked**  - allows all tags and attributes. Use this only on completely trusted data, as it allows trivial cross-site scripting attacks if an attacker can control the String being converted.

-

  \-  **CustomWhitelist**  - create your own whitelist of elements. The whitelist is a **Dict(3kaya)** with the allowed elements as the key and the list of allowed attributes for that element as the value. The string "\*" will match any element as the key, or any attribute as an item in the value list, which is generally not a good idea for anything other than completely trusted data.

For the **InlineOnly**  and **AllElements**  options, you also need to select a **HTMLDocument.ConversionSafety (3kaya)**

## AUTHORS

Kaya standard library by Edwin Brady, Chris Morris and others (kaya@kayalang.org). For further information see http://kayalang.org/

## LICENSE

The Kaya standard library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License (version 2.1 or any later version) as published by the Free Software Foundation.

## RELATED

**HTMLDocument.ConversionSafety (3kaya)**

**HTMLDocument.readFromString (3kaya)**