docusealco/docuseal · error · Submitters::NormalizeValues::InvalidDefaultValue

HTML content is not allowed: #{value.first(200)}...

Error message

HTML content is not allowed: #{value.first(200)}...

What it means

Submitters::NormalizeValues#find_or_create_blob_from_html (lib/submitters/normalize_values.rb:236) raises InvalidDefaultValue 'HTML content is not allowed' unconditionally — the method body is just the raise. HTML-to-image rendering for image field defaults has been removed from the product; the API-only gate one level up (line 218) lets purpose :api through to here, so even API callers now get this error. It is a hard feature retirement, not a data problem.

Source

Thrown at lib/submitters/normalize_values.rb:236

          raise InvalidDefaultValue, "Invalid #{type} value" unless purpose == :api

          find_or_create_blob_from_html(account, value, field)
        else
          raise InvalidDefaultValue, "Invalid value, url, base64 or text < 60 chars is expected: #{value.first(200)}..."
        end

      attachment = for_submitter.attachments.find_by(blob_id: blob.id) if for_submitter

      attachment ||= ActiveStorage::Attachment.new(
        blob:,
        name: 'attachments'
      )

      attachment
    end

    def find_or_create_blob_from_html(_account, value, _field)
      raise InvalidDefaultValue, "HTML content is not allowed: #{value.first(200)}..."
    end

    def find_or_create_blob_from_base64(account, data, type, mime_type: nil)
      checksum = Digest::MD5.base64digest(data)

      blob = find_blob_by_checksum(checksum, account)

      return blob if blob

      mime_type ||= Marcel::MimeType.for(data)

      detected_extensions = Marcel::TYPE_EXTS[mime_type].to_a.map(&:downcase)

      if detected_extensions.any? { |e| Submitters::DANGEROUS_EXTENSIONS.include?(e) }
        raise InvalidDefaultValue, "File type '.#{detected_extensions.first}' is not allowed."
      end

      extension = detected_extensions.first

View on GitHub (pinned to 004a22c1c8)

Solutions

  1. Pre-render the HTML to a PNG/JPEG in your own stack (headless browser, wkhtmltoimage) and send it as base64 or a URL.
  2. Search your codebase for default_value payloads starting with '<html' / '<!DOCTYPE' and replace them with rendered images.
  3. If you cannot render client-side, upload the image as a file attachment instead of an image-field default.

Example fix

# before
default_value = '<html><body><h1>Approved</h1></body></html>'

# after
default_value = "data:image/png;base64,#{Base64.strict_encode64(rendered_png_bytes)}"
Defensive patterns

Strategy: validation

Validate before calling

# Reject/transform HTML before it reaches the server
raise ArgumentError, 'render HTML to an image client-side' if value.match?(/\A\s*<(html|!doctype)/i)

Try / catch

begin
  Submitters::NormalizeValues.normalize_attachment_value(value, field, account, attachments, purpose: :api)
rescue Submitters::NormalizeValues::InvalidDefaultValue => e
  render json: { error: 'HTML image defaults are no longer supported; send base64 or a URL' }, status: :unprocessable_entity
end

Prevention

When it happens

Trigger: POST /api/v1 submissions or template field updates passing an '<html>...' or '<!DOCTYPE...' default_value for an image field; legacy API clients that still generate HTML image defaults.

Common situations: Integrations written against older Docuseal versions where HTML image defaults worked and never migrated; migration to a self-hosted build that removed the renderer dependency.

Related errors

AI-assisted analysis of docusealco/docuseal@004a22c1c8 (2026-08-21). Data as JSON: /api/errors/bc8cf3ed6e3602a7. Report an issue: GitHub.