I'm currently considering using a free theme for my a Website, they use bootstraps Carousel to render a slideshow/banner, and their advice on how to make that slideshow work is to embed HTML in a block an set it to Full HTML. Tutorial here

My question is if there are security risks attached to having a Full HTML block?

Or does Drupal (more specifically 8) inherently protects blocks with code/snippets in?

If so, to which extent should one utilize it, instead of e.g. building a custom block?

  • This is not specific to a block. If you grant a user access to the text format "Full HTML", he can use it on any text field, in a block, a node or any other entity that has a text field he can apply it on. So the security question here is who you give the credentials for an account that has access to this text format.
    – 4uk4
    May 3, 2017 at 18:32

1 Answer 1


In general, you should probably only give Full HTML access to only your most trusted users (which may only be the site administrator).

Now the example you linked to was intended to be used in a block. Block administration is also something that will likely only be done by your site administrators. Every site needs an administration plan, so it's fair to ask, can the people entrusted with block creation also be entrusted with the use of Full HTML? If so, no need to create a custom block.

Alternatively, the example code is fairly benign, so you could add a Text Format that allowed for the use of those tags & attributes (admin -> configuration -> content authoring -> text formats and editors). I often create a Text Format called Advanced HTML that allows for most tags but I don't include any of the potentially problematic tags like script, object, style, etc.

To produce that carousel, looks like you would minimally need the following:

<div id class role data-*><ol class><li class data-*><img src alt><h3><p>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.