Spotfire Analyst: HTML Sanitation Setting in No-Server / Work Offline Mode

This article describes how to control HTML sanitation behavior in Spotfire Analyst when running without a server connection ("No server" login mode / Work Offline mode). Because the Administration Manager UI (Tools > Administration Manager > Preferences > Text Area > PerformHtmlSanitation) requires a server connection, offline environments must configure this setting via Spotfire.Dxp.Main.dll.config.
This is a client-side, per-machine configuration setting and does not persist across upgrades.

 

Prior to December 5, 2024, changing this setting offline was unsupported. The fix was tracked and released under the following defect IDs:

 

TS-79058 — fixed in HF-019 for Spotfire 14.0.x LTS (SPOT_sfire_deploy_14.0.5.145)

TS-79059 — fixed in HF-008 for Spotfire 14.4.x (SPOT_sfire_deploy_14.4.1.55)

 

Setting Desktop_Preference_PerformHtmlSanitation to false only takes effect on these hotfix versions or newer. Earlier versions accept the XML entry without error, but ignore the setting. 

 

Security Warning: HTML sanitation strips potentially malicious tags/scripts from HTML content rendered inside Spotfire (e.g., in Text Areas or custom HTML visualizations). Disabling sanitation is strongly discouraged in environments handling unverified external content.

 

These are the instructions to make this change: 

 

1. Close all running instances of Spotfire Analyst.

2. Navigate to the Modules directory inside your Spotfire installation folder (e.g., C:\Program Files\Tibco\Spotfire Analyst\\Modules).

3. Open the folder starting with Spotfire DXP Forms_.

4. Launch a text editor (e.g., Notepad) as Administrator and open Spotfire.Dxp.Main.dll.config.

5. Locate the XML section near the end of the file.

6. Locate an existing entry such as:

 

<setting name="Desktop_Preference_UseWhitelistForSecuritySensitiveUris" serializeAs="String"> 
<value>true</value> 
</setting>

 

7. Add the following entry within the same block:

 

<setting name="Desktop_Preference_PerformHtmlSanitation" serializeAs="String">
<value>false</value> 
</setting>

(Set to true to enable sanitation [default] or false to disable it.)

 

8. Save the file and restart Spotfire Analyst.

 

Note: This configuration is overwritten whenever a product update or hotfix is applied and must be manually reapplied after upgrades.