# Html element whitelisting in plugin not taking effect server side

**URL:** https://meta.discourse.org/t/html-element-whitelisting-in-plugin-not-taking-effect-server-side/66175
**Category:** Support
**Created:** [July 14, 2017, 4:39am UTC](https://meta.discourse.org/t/html-element-whitelisting-in-plugin-not-taking-effect-server-side/66175 "2017-07-14T04:39:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Benjamin\_Mosior](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@Benjamin\_Mosior](https://meta.discourse.org/u/Benjamin_Mosior)
#### Post date: [July 14, 2017, 4:39am UTC](https://meta.discourse.org/t/html-element-whitelisting-in-plugin-not-taking-effect-server-side/66175/1 "2017-07-14T04:39:44Z")

</div>

I’m working with a group that focuses heavily on personal knowledge management (they use Evernote and similar software). Highlighting is important to them, so I’d like to support the [`<mark>`](https://www.w3schools.com/tags/tag_mark.asp) html tag in posts through a plugin. I would like to avoid bbcode or using `<ins>` if possible. (As an aside, official support for `<mark>` could be neat.)

Based on what I could find in these forums and reading through the source code, I landed on the following directive to whitelist the tag in `assets/javascripts/lib/discourse-markdown/my-plugin.js.es6`:

```plaintext
// snip

export function setup(helper) {
  helper.whiteList(['mark']);
}

```

The above works client-side but fails server-side (the tags are stripped out).

 ![](https://global.discourse-cdn.com/meta/original/3X/d/e/de5d47bd65580f6f5f3a567877cd012d07cee65d.png)

(As an aside, you can see I’m also adding a button for it as well. Love how easy that was to do!)

I’m taking an educated guess (based on other forum posts) that this is related to the `html_to_markdown` function. This test fails despite the whitelist above:

```plaintext
require 'rails_helper'
require 'html_to_markdown'

describe HtmlToMarkdown do

  def html_to_markdown(html, opts={})
    HtmlToMarkdown.new(html, opts).to_markdown
  end

  it "supports <mark>" do
    expect(html_to_markdown("<mark>Highlighted</mark>")).to eq("<mark>Highlighted</mark>")
  end

end

```

```plaintext
Failures:

  1) HtmlToMarkdown supports <mark>
     Failure/Error: expect(html_to_markdown("<mark>Highlighted</mark>")).to eq("<mark>Highlighted</mark>")

       expected: "<mark>Highlighted</mark>"
            got: "Highlighted"

       (compared using ==)

```

Is this a reasonable pursuit? What am I missing to provide support for this server-side?

---

<div class="post-metadata">

### Author: ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [July 14, 2017, 10:24am UTC](https://meta.discourse.org/t/html-element-whitelisting-in-plugin-not-taking-effect-server-side/66175/2 "2017-07-14T10:24:47Z")

</div>

Do you use reply by email often, as I thought HtmlToMarkdown was only utilized by incoming emails. Here is my spec (which @sam graciously wrote when upgrading to the new markdown engine)

```ruby
require 'rails_helper'

describe PrettyText do

  context 'markdown it' do
    before do
      SiteSetting.enable_experimental_markdown_it = true
    end

    it 'can properly bake boxes' do
      md = <<~MD
        [],[],[_];[-]X[x]X [*] [\\*] are all checkboxes
        `[]` [x](hello) *[]* **[]** are not checkboxes
      MD

      html = <<~HTML
        <p><span class="chcklst-box fa fa-square-o"></span>,<span class="chcklst-box fa fa-square-o"></span>,<span class="chcklst-box fa fa-square"></span>;<span class="chcklst-box fa fa-minus-square-o"></span>X<span class="chcklst-box checked fa fa-check-square"></span>X <span class="chcklst-box checked fa fa-check-square-o"></span> <span class="chcklst-box checked fa fa-check-square-o"></span> are all checkboxes<br>
        <code>[]</code> <a>x</a> <em>[]</em> <strong>[]</strong> are not checkboxes</p>
      HTML
      cooked = PrettyText.cook(md)
      expect(cooked).to eq(html.strip)
    end
  end
end

```

And my whitelist that seems to work both server-side and client-side

```plaintext
export function setup(helper) {
  helper.whiteList([ 'span.chcklst-stroked',
                     'span.chcklst-box fa fa-square-o',
                     'span.chcklst-box fa fa-square',
                     'span.chcklst-box fa fa-minus-square-o',
                     'span.chcklst-box checked fa fa-check-square',
                     'span.chcklst-box checked fa fa-check-square-o' ]);
}

```

---

<div class="post-metadata">

### Author: ![Benjamin\_Mosior](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@Benjamin\_Mosior](https://meta.discourse.org/u/Benjamin_Mosior)
#### Post date: [July 14, 2017, 3:17pm UTC](https://meta.discourse.org/t/html-element-whitelisting-in-plugin-not-taking-effect-server-side/66175/3 "2017-07-14T15:17:36Z")

</div>

Taking another glance at the source code, right you are. That should have been obvious. My bad!

So the query changes… My whitelist is not taking effect server-side and I don’t know why.

I’ll take a look at your spec and see what I find out. Thanks!

---

<div class="post-metadata">

### Author: ![Benjamin\_Mosior](https://avatars.discourse-cdn.com/v4/letter/b/59ef9b/32.png) [@Benjamin\_Mosior](https://meta.discourse.org/u/Benjamin_Mosior)
#### Post date: [July 14, 2017, 3:27pm UTC](https://meta.discourse.org/t/html-element-whitelisting-in-plugin-not-taking-effect-server-side/66175/4 "2017-07-14T15:27:51Z")

</div>

Alright, I’m confounded. Must have been some sort of caching issue. The only change I introduced was rebooting the Vagrant box.

 ![](https://global.discourse-cdn.com/meta/original/3X/c/e/ce4d3ec0d93218786da7cefc77ce35cbf6b47de8.png)

The spec passes, and highlighting takes effect like I’d expect.

```plaintext
require 'rails_helper'

describe PrettyText do

  context 'markdown it' do
    before do
      SiteSetting.enable_experimental_markdown_it = true
    end

    it 'can properly bake highlights' do
      md = <<~MD
        This is a <mark>highlighted phrase</mark>.
      MD

      html = <<~HTML
        <p>This is a <mark>highlighted phrase</mark>.</p>
      HTML
      cooked = PrettyText.cook(md)
      expect(cooked).to eq(html.strip)
    end
  end
end

```

Thanks for pushing me in the right direction!

Just in case anyone would like to take a look at the source for their own plugin work, here it is:

> **[fortelabs / discourse-progressive-summarization · GitLab](https://gitlab.com/fortelabs/discourse-progressive-summarization)**
>
> A Discourse plugin to enable the use of progressive summarization techniques.

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 8, 2024, 12:44pm UTC](https://meta.discourse.org/t/html-element-whitelisting-in-plugin-not-taking-effect-server-side/66175/5 "2024-06-08T12:44:28Z")

</div>

This topic was automatically closed after 2521 days. New replies are no longer allowed.