CODEWITHSUNDEEP
htmljsfjsf-2primefaces
Nikola
Nikola

Reputation: 624

Displaying HTML from DB in <h:outputText escape="false"> results in broken HTML page

Is there any way to setup Firefox and Chrome to work with escape=false attribute in h:outputText tag. When there is some html that needs to be shown in the browser, Firefox and Chrome show parsed string correctly, but any other links in application are freezed (??).

The example html from db:

<HEAD>
<BASE href="http://"><META content="text/html; charset=utf-8" http-equiv=Content-Type>          
<LINK rel=stylesheet type=text/css href=""><META name=GENERATOR content="MSHTML 9.00.8112.16434">
</HEAD>
<BODY><FONT color=#000000 size=2 face="Segoe UI">läuft nicht</FONT></BODY>

Parsed HTML on the page:

läuft nicht

What is very weird, is that in IE everything works (usually it is opposite).

I use primefaces components (v2.2), .xhtml, tomcat 7 and JSF 2.0

Upvotes: 1

Views: 3040

Answers (2)

BalusC
BalusC

Reputation: 1108802

You end up with syntactically invalid HTML this way:

<html>
    <head></head>
    <body>
        <head></head>
        <body>...</body>
    </body>
</html>

This is not right. There can be only one <head> and <body>. The browsers will behave unspecified. You need to remove the entire <head> and the wrapping <body> from that HTML so that you end up with only

<FONT color=#000000 size=2 face="Segoe UI">läuft nicht</FONT>

You'd need to either update the DB to remove unnecessary HTML, or to use Jsoup to parse this piece out on a per-request basis something like as follows:

String bodyContent = Jsoup.parse(htmlFromDB).body().html();
// ...

Alternatively, you could also display it inside a HTML <iframe> instead with help of a servlet. E.g.

<iframe src="htmlFromDBServlet?id=123"></iframe>

Unrelated to the concrete problem:

  1. Storing HTML in a DB is a terrible design.
  2. If the HTML originates from user-controlled input, you've a huge XSS attack hole this way.
  3. The <font> tag is deprecated since 1998.

Upvotes: 6

Neil
Neil

Reputation: 5780

It seems to me that you're trying to do something that JSF was not really meant to do. Rather than try to insert HTML in your web page, you ought to try having the links already on your page and modifying the "rendered" attribute through an AJAX call.

Upvotes: 1

Related Questions