CODEWITHSUNDEEP
jsfjsf-2
user207782
user207782

Reputation: 11

How to skip rendering images in Jsf

I have a html string which contains images and text. While rendering, I only want to render the text and not the images.

I tried to do this :

<h:outputText escape="false" value="#{fn:replace(answerBlock.content,'&lt;img&gt;','')}" />

but this returned a malformed html which then rendered on the screen .

How can I skip the img tags and just render the text in jsf ?

Upvotes: 1

Views: 138

Answers (2)

BalusC
BalusC

Reputation: 1108632

Do not use string or regex functions to manipulate user-controlled HTML. The risk for a XSS attack hole is in this particular example very big as not all aspects are covered (e.g. <script>, onclick, etc). Just use a real HTML parser which is aware of XSS implications. For example Jsoup which has also a whitelist sanitizer feature.

String sanitizedHtml = Jsoup.clean(dirtyHtml, Whitelist.basic());

Then display that instead:

<h:outputText value="#{bean.sanitizedHtml}" escape="false" />

To improve performance, consider parsing it only once and saving in DB along with raw data.

See also:

Upvotes: 5

Lucas
Lucas

Reputation: 14919

I would add code to your answerBlock bean. Something like:

public String imageStrippedContent() {
    return stripImgTags( content() );
}

private String stripImgTags( String html ) {
    // strip img tag using dom parser like jtidy, or maybe regex
    ...
}

Then modify your facelet to:

<h:outputText escape="false" value="#{answerBlock.imageStrippedContent} />

Upvotes: 0

Related Questions