CODEWITHSUNDEEP
aemsanitizationhtml-sanitizing
Kevin Kulla
Kevin Kulla

Reputation: 460

Sanitizing inputs with AEM

We have various people updating our AEM website however when they copy and paste from word or from online it retains the HTML. I'm wondering if AEM has any built-in way of sanitizing the input so I don't need to build one.

Upvotes: 2

Views: 1011

Answers (3)

Ana Vinatoru
Ana Vinatoru

Reputation: 191

The usual approach in AEM is to protect the user on output (i.e. take the input as-is and use the built-in XSS API when rendering that input).

https://docs.adobe.com/docs/en/cq/5-6-1/deploying/security_checklist.html#Protect%20against%20Cross-Site%20Scripting%20%28XSS%29

https://docs.adobe.com/content/docs/en/cq/5-6-1/developing/securitychecklist/_jcr_content/par/download/file.res/xss_cheat_sheet.pdf

Upvotes: 0

Saravana Prakash
Saravana Prakash

Reputation: 1323

We had a rich text edit component with same issue wherein authors were able to place HTML styling onto RTE and the placed styles were colliding with application styles and was breaking components. Fix was, we stripped out all HTML styling using jsoup API before rendering back on screen.

Upvotes: 0

brunovianarezende
brunovianarezende

Reputation: 866

If you are using Rich Text Editor field in the dialog then the text will be parsed and some tags will be stripped. Take a look here for more information about how to configure it and how it works.

Upvotes: 3

Related Questions