# Using \<style\> tags in displayHtml field

**URL:** <https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142>\
**Category:** Technical\
**Created:** [October 18, 2019, 1:07pm UTC](https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142 "2019-10-18T13:07:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![s.ermakovich](https://sea2.discourse-cdn.com/flex016/user_avatar/community.blockcerts.org/s.ermakovich/32/635_2.png) [@s.ermakovich](https://community.blockcerts.org/u/s.ermakovich)\
**Post date:** [October 18, 2019, 1:07pm UTC](https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142/1 "2019-10-18T13:07:14Z")

</div>

Hello,

We would like to use custom fonts declared via `@font-face` CSS directive defined in `<style>` tag, but unfortunately [blockcerts.org](http://blockcerts.org) certificate viewer seems to remove any `<style>` tags, despite that certificate html is placed inside of shadow DOM and I believe all `<style>` tags are encapsulated in this case and do not affect outer DOM. Is there any other reason for removing `<style>` tags? Or is there any alternative for loading custom fonts?

Many thanks in advance.

---

<div class="post-metadata">

**Author:** ![lm-mc](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@lm-mc](https://community.blockcerts.org/u/lm-mc)\
**Post date:** [October 22, 2019, 12:01am UTC](https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142/2 "2019-10-22T00:01:44Z")

</div>

Hi Siarhei!

This is a good point and I could see this very useful.  
@lemoustachiste was there a reason we didn’t whitelist the `<style>` tag before?

---

<div class="post-metadata">

**Author:** ![lemoustachiste](https://avatars.discourse-cdn.com/v4/letter/l/7c8e57/32.png) [@lemoustachiste](https://community.blockcerts.org/u/lemoustachiste)\
**Post date:** [October 22, 2019, 1:29pm UTC](https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142/3 "2019-10-22T13:29:55Z")

</div>

We are filtering out `style` tags to prevent possible XSS attack:  
if you look though this page: [https://www.owasp.org/index.php/XSS\_Filter\_Evasion\_Cheat\_Sheet](https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet) and search for style, there are various cases that could open the door to such attack. Since we don’t have control over the HTML injected into the verifier and its location, and that it would be complicated to safe guard against all weaknesses in that code, it seems safer to just exclude the `style` tag.

I haven’t researched the possibility of loading custom fonts since we only rely on system fonts, so I don’t have anything to propose to you at this point. But I am not closed to the idea, we just need a clean way to do it.

---

<div class="post-metadata">

**Author:** ![s.ermakovich](https://sea2.discourse-cdn.com/flex016/user_avatar/community.blockcerts.org/s.ermakovich/32/635_2.png) [@s.ermakovich](https://community.blockcerts.org/u/s.ermakovich)\
**Post date:** [October 22, 2019, 5:16pm UTC](https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142/4 "2019-10-22T17:16:14Z")

</div>

@lemoustachiste I see, thanks for explaining. Will try to avoid using custom fonts for now.

---

<div class="post-metadata">

**Author:** ![s.ermakovich](https://sea2.discourse-cdn.com/flex016/user_avatar/community.blockcerts.org/s.ermakovich/32/635_2.png) [@s.ermakovich](https://community.blockcerts.org/u/s.ermakovich)\
**Post date:** [November 13, 2019, 6:15pm UTC](https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142/5 "2019-11-13T18:15:39Z")

</div>

@lemoustachiste I just noticed `<svg>` tags also seem to be removed. Is it due to the same security concerns?

---

<div class="post-metadata">

**Author:** ![lm-mc](https://avatars.discourse-cdn.com/v4/letter/l/5fc32e/32.png) [@lm-mc](https://community.blockcerts.org/u/lm-mc)\
**Post date:** [November 13, 2019, 8:50pm UTC](https://community.blockcerts.org/t/using-style-tags-in-displayhtml-field/2142/6 "2019-11-13T20:50:23Z")

</div>

@s.ermakovich Correct, the sanitizer takes it out.