Antisamy Hook issues with webcontent

[6年前 に Kowbathullah Gnaniyar によって更新されました。]

HI,

we have deployed antisamy hook in liferay 6.2 version for security reason to protect against the malicious code.
But issue is after deploying the hook, when we try to add the webcontent with HTML 5 attributes like data-title or data-value, portal is filtering those attributes in web content .
For example,

if we add this below content:
Option 2

After publishing the content, it changed like,
Option 2

it is possible to update the policy for html 5 attributes or any guess why it is happening?

[6年前 に Samuel Kong によって更新されました。]

You can replace the default policy file (sanitizer-configuration.xml) with your own policy file. For more info on AntiSamy's policy files, check out the AntiSamy Developer Guide.

[6年前 に Kowbathullah Gnaniyar によって更新されました。]

Samuel Kong:

You can replace the default policy file (sanitizer-configuration.xml) with your own policy file. For more info on AntiSamy's policy files, check out the AntiSamy Developer Guide.

Thanks samuel for your quick response . I will try to update the policy file.

But my question is, if we are using custom filter for XSS vulnerability issues, can we remove the antisamy hook?

[6年前 に Samuel Kong によって更新されました。]

The answer is it depends. It depends on your custom filter and whether you think it's sufficient to for your use cases.

[6年前 に Kowbathullah Gnaniyar によって更新されました。]

Samuel Kong:

The answer is it depends. It depends on your custom filter and whether you think it's sufficient to for your use cases.

Thanks. It works. I just added custom validation and rules in sanitizer-configuration.xml file . Actually when I added data-table attributes in table entity, antisamy filter doesn't accept as it assumes it would be some malicious script. so it was removed after validation checks. So i added new rule for table in configuration xml file.