diff --git a/frappe/utils/html_utils.py b/frappe/utils/html_utils.py
index 091c6047db..7af5ab9907 100644
--- a/frappe/utils/html_utils.py
+++ b/frappe/utils/html_utils.py
@@ -142,7 +142,7 @@ def clean_script_and_style(html):
return frappe.as_unicode(soup)
-def sanitize_html(html, linkify=False, always_sanitize=False):
+def sanitize_html(html, linkify=False, always_sanitize=False, disallowed_tags=None):
"""
Sanitize HTML tags, attributes and style to prevent XSS attacks
Based on nh3 clean, bleach whitelist and html5lib's Sanitizer defaults
@@ -167,6 +167,10 @@ def sanitize_html(html, linkify=False, always_sanitize=False):
.union(["html", "head", "meta", "link", "body", "o:p"])
)
+ # Allow caller to explicitly disallow some tags
+ if disallowed_tags:
+ tags.difference_update(disallowed_tags)
+
attributes = {"*": acceptable_attributes, "svg": svg_attributes}
# returns html with escaped tags, escaped orphan >, <, etc.