This document lists the HTML codes that are permissible in Canvas. When creating custom HTML coding in Canvas, certain HTML codes do not work upon saving. This is because Canvas only supports certain HTML elements for security reasons. This also applies to content copied and pasted from an external source.
Exceptions: Pages remove object and embed. Calendar event descriptions remove object, embed, param, and any iframe that isn't a Canvas media or app launch path starting with a slash. Discussion replies don't allow id except on links used for inline media. Notification emails keep only basic text formatting.
Allowed HTML Tags
a, abbr, acronym, address, area, article, aside, audio, b, bdo, big, blockquote, br, caption, cite, code, col, colgroup, dd, del, details, dfn, div, dl, dt, em, embed, figcaption, figure, font, footer, h1, h2, h3, h4, h5, h6, header, hr, i, iframe, img, ins, kbd, legend, li, map, mark, nav, object, ol, p, param, picture, pre, q, rp, rt, ruby, samp, section, small, source, span, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, time, tr, track, tt, u, ul, var, video
MathML tags
annotation, annotation-xml, maction, maligngroup, malignmark, math, menclose, merror, mfenced, mfrac, mglyph, mi, mlabeledtr, mlongdiv, mmultiscripts, mn, mo, mover, mpadded, mphantom, mprescripts, mroot, mrow, ms, mscarries, mscarry, msgroup, msline, mspace, msqrt, msrow, mstack, mstyle, msub, msubsup, msup, mtable, mtd, mtext, mtr, munder, munderover, none, semantics
Note: The annotation-xml element is allowed only with non-HTML encodings. If its encoding attribute is text/html or application/xhtml+xml, the element and everything inside it is removed. Other encodings, such as MathML-Content, MathML-Presentation, and application/x-tex, are kept.
Allowed Attributes on HTML Elements
These attributes are allowed on any element: style, class, id, title, role, lang, dir, any aria-* attribute, and any data-* attribute.
A few id values are not allowed, because they conflict with names the browser uses internally — for example id="body" or id="length".
The table below shows the attributes that are meaningful on each element.
Element | Allowed Attribute(s) |
|---|
a | href, target, name, rel, download |
abbr | title |
area | alt, coords, href, shape, target |
audio | name, src, muted, controls, allowfullscreen, allow, poster, width, height, playsinline |
blockquote | cite |
col | span, width |
colgroup | span, width |
del | cite, datetime |
embed | allowfullscreen, height, name, src, type, width |
font | deprecated: do not use in new content face, color, size |
img | align, alt, height, src, title, usemap, width, srcset, loading, decoding |
iframe | src, width, height, name, align, allowfullscreen, frameborder, scrolling, sandbox, loading, allow, webkitallowfullscreen, mozallowfullscreen |
ins | cite, datetime |
map | name |
object | data, height, type, width |
ol | start, type, reversed |
param | name, value |
q | cite |
source | height, media, sizes, src, srcset, type, width |
table | summary, width, border, cellpadding, cellspacing, frame |
tr | align, valign, dir |
track | default, kind, label, src, srclang |
td | abbr, axis, colspan, rowspan, width, align, valign, dir |
th | abbr, colspan, rowspan, width, align, valign, dir, scope |
ul | type |
video | name, src, allowfullscreen, muted, poster, width, height, controls, playsinline, allow, preload, loop |
Note: data- attributes.* Six attribute names are renamed when content is saved. The value is kept, but the name changes:
You write | Canvas saves |
|---|
data-url | data-custom-url |
data-method | data-custom-method |
data-remote | data-custom-remote |
data-remove | data-custom-remove |
data-confirm | data-custom-confirm |
data-disable-with | data-custom-disable-with |
Note: the sandbox attribute on iframes. Canvas checks each token in a sandbox value and removes any it doesn't recognize. It also removes allow-top-navigation and allow-top-navigation-to-custom-protocols. These tokens are supported: allow-modals, allow-orientation-lock, allow-pointer-lock, allow-popups, allow-popups-to-escape-sandbox, allow-presentation, allow-same-origin, allow-scripts, allow-storage-access-by-user-activation, allow-top-navigation-by-user-activation, allow-downloads, allow-forms.
If every token is removed, the attribute stays as sandbox="", which is the most restrictive setting.
Allowed protocols
Canvas checks the beginning of every link, image source, and embed source. These are allowed:
Scheme | Example |
|---|
https: | https://www.example.com |
http: | http://www.example.com |
ftp: | ftp://files.example.com/handout.pdf |
mailto: | mailto:teacher@example.com |
tel: | tel:+15551234567 |
Links that open in a new tab. If you write target="_blank", Canvas adds rel="noopener" when the content is saved.
Allowed style properties
Longhand properties are supported wherever the shorthand is listed. For example, border includes border-color, border-width, and border-top-style; font includes font-size and font-weight; background includes background-image and background-size.
Category | Properties |
|---|
Layout | clear, display, float, overflow, overflow-x, overflow-y, position, visibility, z-index, zoom |
Offsets | bottom, left, right, top |
Size | aspect-ratio, box-sizing, height, max-height, max-width, min-height, min-width, object-fit, object-position, resize, width |
Spacing | column-gap, gap, margin, padding, row-gap |
Text | color, direction, font, font-feature-settings, font-kerning, font-optical-sizing, font-variant-caps, font-variant-ligatures, font-variant-numeric, letter-spacing, line-height, text-align, text-align-last, text-decoration, text-indent, text-shadow, text-transform, text-underline-offset, unicode-bidi, vertical-align, word-spacing |
Text flow | hyphens, line-break, overflow-wrap, tab-size, text-combine-upright, text-orientation, text-overflow, white-space, word-break, word-wrap, writing-mode |
Borders and background | background, border, border-collapse, border-radius, border-spacing, box-shadow, outline, outline-offset |
Lists and tables | caption-side, empty-cells, list-style, table-layout |
Flexbox and grid | align-content, align-items, align-self, flex, grid, justify-content, justify-items, justify-self, order, place-content, place-items, place-self |
Multi-column | column-count, column-fill, column-rule, column-span, column-width, columns |
Motion | animation, transform, transition |
Printing | break-after, break-before, break-inside, page-break-after, page-break-before, page-break-inside |
Generated content | content, counter-increment, counter-reset, quotes |
Interaction | accent-color, appearance, caret-color, cursor, opacity, pointer-events, user-select |
The position property is allowed only with the values static, relative, and absolute, and the CSS keyword resets (initial, inherit, unset, revert, revert-layer). The values fixed and sticky are removed for security reasons, because they allow content to overlay the Canvas interface.
These rules apply to the style attribute on an element.
This resource can also be accessed from the following Canvas Guides: