HTML sanitization

To prevent certain security exploits, Looker restricts which HTML tags, HTML tag attributes, and CSS properties are allowed in the html parameter, in custom welcome emails, and in text tiles and tile notes in dashboards.

Looker strips any HTML elements that aren't supported from the rendered HTML. For example, the following HTML has unsupported HTML tags:

<div class="pretty"><badtag></badtag></div>

Looker will render this as:

<div class="pretty"></div>

As another example, the following HTML has unsupported HTML attributes:

<div class="pretty" badattr="uh-oh"></div>

Looker will render this as:

<div class="pretty"></div>

HTML sanitization is on by default and can't be edited.

Allowed HTML tags

Only certain HTML tags will be rendered in the browser. Any other tags will be stripped from rendered HTML.

Here is the list of HTML tags that Looker supports:

Allowed HTML tag attributes

Only certain HTML attributes will be rendered in the browser. Any other attributes will be stripped from rendered HTML. This also applies to the CSS properties for HTML style tags.

Here is the list of HTML attributes that Looker supports:

Allowed CSS Properties for HTML style Tags

Here is the list of allowed CSS properties that Looker supports: