How to prevent richtext component from stripping off script tags?

[jura_khrapunov]

After update from CQ 5.5 to AEM 5.6.1 we are facing situation when richtext component is stripping <script /> tags entered via "HTML source" mode. What is the preferred way of configuring this behavior?

[Sham_HC · Accepted solution]

Overlay WhitespaceProcessor.js & HtmlSerializer.js

• In WhitespaceProcessor in tagname remove script
• At  HtmlSerializer modify the method serializeTextNode to return  dom.nodeValue without replace

[smacdonald2008]

Here is a similar issue:

https://forums.adobe.com/thread/1019650

[jura_khrapunov]

Hi Sham,

There are two WhitespaceProcessor.js files in AEM 5.6.1:

• /etc/clientlibs/granite/coralui/optional/rte/js/core/WhitespaceProcessor.js from rte.coralui clientlib
• /libs/cq/ui/rte/core/WhitespaceProcessor.js from cq.rte

It seems that first one is for Touch UI and second is for Classic UI and I have to overlay them both, correct? In that case how I can overlay /etc/clientlibs file? It's pretty straightforward how to overlay files under /libs, but what about /etc?

[jura_khrapunov]

I've seen that and it isn't the same. It was about one very specific element - ID attribute in HTML tags. I need to find a way how to configure Ext in AEM to avoid stripping off arbitrary tags, not just ID attributes.

[jura_khrapunov]

smacdonald2008 wrote...

Here is a similar issue:

https://forums.adobe.com/thread/1019650

It's not the same, I need to prevent stripping off HTML tags, not just ID attribute

[smacdonald2008]

See the RTE Reference docs:

http://dev.day.com/docs/en/cq/current/widgets-api/index.html?class=CQ.form.RichText

See: stripHtmlTags. Set this to false. See if that helps. 

[Sham_HC]

jura.khrapunov wrote...

Hi Sham,

There are two WhitespaceProcessor.js files in AEM 5.6.1:

• /etc/clientlibs/granite/coralui/optional/rte/js/core/WhitespaceProcessor.js from rte.coralui clientlib
• /libs/cq/ui/rte/core/WhitespaceProcessor.js from cq.rte

It seems that first one is for Touch UI and second is for Classic UI and I have to overlay them both, correct? In that case how I can overlay /etc/clientlibs file? It's pretty straightforward how to overlay files under /libs, but what about /etc?

You are right etc cannot be overlayed.  However 5.6.1 coral has not complete ready so you can ignore & I tested only for classic ui.

[1]  http://www.aemstuff.com/#article970

[jura_khrapunov]

smacdonald2008 wrote...

See the RTE Reference docs:

http://dev.day.com/docs/en/cq/current/widgets-api/index.html?class=CQ.form.RichText

See: stripHtmlTags. Set this to false. See if that helps. 

This one has no effect for the code typed in in the HTML source edit mode in richtext editor component. It only affects copy/pasted text and, according to the docs, already deprecated