Output HTML text entered as is instead of escaping it | Community
Skip to main content
Level 4
October 16, 2015
Solved

Output HTML text entered as is instead of escaping it

  • October 16, 2015
  • 4 replies
  • 1675 views

We want the text component to be modified that "ANY" html should be interpreted as is. RTE doesn't allow say for example to insert <font style='10px'> etc. We want to create this as the authors are requesting complete control. As much as style and css are right options, the authors WANT that option available to ahve multiple formattings in same paragraph.

 

We've tried the following, 

<% String text2 = properties.get("text", "");
      out.print(text2);
%>
<cq:text property="text" escapeXml="true"/>

 

Both if text is <u>Sample text</u>

Do not interpret it and render it as is. However if we use <% out.println("<b>Sample</b>");%> it does work and makes the text bold. Is there a way to do this or the platform will ALWAYS deny it?

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by JustinEd3

Hi,

The best thing to do is to modify the XSS Protection configuration to allow the font tag. See http://docs.adobe.com/docs/en/aem/6-0/administer/security/security-checklist.html#Protect%20against%20Cross-Site%20Scripting%20%28XSS%29.

Regards,

Justin

4 replies

JustinEd3Adobe EmployeeAccepted solution
Adobe Employee
October 16, 2015

Hi,

The best thing to do is to modify the XSS Protection configuration to allow the font tag. See http://docs.adobe.com/docs/en/aem/6-0/administer/security/security-checklist.html#Protect%20against%20Cross-Site%20Scripting%20%28XSS%29.

Regards,

Justin

Level 4
October 16, 2015

Justin

How does the RTE work then? RTE allows you to bold and underline text. How does it bypass this rule setting?

Is it because all the allowed actions in RTE component are enabled in the configuration>

Adobe Employee
October 16, 2015

Correct - the HTML output by the standard RTE plugins is generally allowed under the default XSS protection configuration.

Level 8
October 16, 2015

Have you checked what is actually being persisted in the repository. The RTE will reformat HTML entered in the source edit option at times. Are you sure that the editor isn't changing your HTML before it's persisted?