Can we use @context='scriptComment' for including JS and html markup | Community
Skip to main content
NehaMa
Level 4
Aug 17, 2021 12:53 PM UTC
Solved

Can we use @context='scriptComment' for including JS and html markup

Hi Team

 

As we should not use context=unsafe to prevent xss vulnerability , is it safe to use textarea field with values with some js code and html markup with context=scriptComment to prevent stripping of script tags

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
BrianKasingli
BrianKasingliAccepted solution
New Participant
Aug 19, 2021 7:32 PM UTC

For HTML and JS, you should try using

${properties.customHTML @ context='html'}          <!--/* Use this in case you want to output HTML - Removes markup that may contain XSS risks */-->

${properties.cusomJS @ context='scriptString'}  <!--/* Applies JavaScript string escaping */-->

HTML Template Language Specification - https://github.com/adobe/htl-spec/blob/master/SPECIFICATION.md

Let me know how it goes,

Brian

View reply

2 replies

BrianKasingli
BrianKasingliAccepted solution
New Participant
Aug 19, 2021 7:32 PM UTC

For HTML and JS, you should try using

${properties.customHTML @ context='html'}          <!--/* Use this in case you want to output HTML - Removes markup that may contain XSS risks */-->

${properties.cusomJS @ context='scriptString'}  <!--/* Applies JavaScript string escaping */-->

HTML Template Language Specification - https://github.com/adobe/htl-spec/blob/master/SPECIFICATION.md

Let me know how it goes,

Brian

Translate
    BimmiSo
    Employee
    Aug 17, 2021 1:00 PM UTC

    Hi @nehama ,

     

    I dont think there should be any issue using context= scriptComments

     

    ${properties.jcr:title @ context='scriptComment'} <!--/* Context for Javascript block comments. Outputs nothing if value break out of the comment context */-->

     

    Hope this helps!!

    Thanks

    Translate
      Terms & ConditionsAccessibility statement

      Loading footer...