Apex Code Development You need to sign in to do that
Don't have an account?
highland23 Creating a method that ensures safe HTML input
We're building an app that requires the user to be able to input raw HTML (for a design template) and then be able to display that within SFDC. The challenge we've found in a security process is that we need to find a way to ensure that the HTML is stripped of any "unsafe" constructs.
While it's been recommended we utilize the ESAPI Validator getValidSafeHTML method...
http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Validator.html#getValidSafeHTML(java.lang.String, java.lang.String, int, boolean)
...that doesn't seem to be included in the ESAI SFDC suite...
http://code.google.com/p/force-dot-com-esapi
Any recommendations as to how we could leverage the ESAPI Validator getValidSafeHTML method within our app, or potentially another way to scrub our HTML to ensure safe constructs?
I wonder how SFDC does this, as it allows you to input raw HTML when creating email templates.
Just as a quick follow-up, someone recommended just building a whitelist of HTML tags that are allowed within the field that we're accepting HTML. That sounds good (we really only need to allow as many HTML tags as something like Gmail allows -- which is notoriously good at this), but also like an arduous endeavor. Any guidance or pre-built packages you can think of would be awesome.
I don't know of a salesforce.com native code, but... I have a viable suggestion if you'll take it.
1) Buy/rent/lease a server that supports PHP and is public.
2) Install http://htmlpurifier.org/.
3) Have your VF page call the API before saving.
That's a potential path that we might need to go down. So far, the only other solution has been to find a way to port the AntiSamy package into Apex, which doesn't sound like a lot of fun. I'll keep you posted as to what we decide to do.