PrimeFaces 7.0 <p:textEditor HTML-sanitizer discards text formatting, such as centering

user_1925356 0
Viewed 662

In PrimeFaces 8, it seems to be possible to enable / disable HMTML -sanitizer when using the <p:textEditor component by just specifying secure='false' for disabling it and secure='true' for enabling it. I tried to disable it in PrimeFaces 7.0 like this:

  <p:textEditor id="quillToolbarId" secure='false' widgetVar="editor2" height="300" value="#{editTemplatesBean.kaufAnbotTemplate}" placeholder="Enter your content">

but the sanitizer still seems to be working.

My problem is that whenever I format a text in the primeFaces p:textEditor to be center-aligned, the HTML sanitizer just removes my formatting, so the text ends up without formatting.

One way to work this around is to use directly Quill and not Sanitize the input.This works, but then I face other problems, such as this one:

https://github.com/quilljs/quill/issues/1379

which also need to be worked-around.

Please help!

quill jsf-2.2 primefaces html-sanitizing
1 Answers

There is no secure property in TextEditor for PrimeFaces 7. If you look at the code of TextEditorRenderer.decode you will see that the sanitzier is called

if (PrimeApplicationContext.getCurrentInstance(context).getEnvironment().isHtmlSanitizerAvailable()) {
    value = HtmlSanitizer.sanitizeHtml(value,
          editor.isAllowBlocks(), editor.isAllowFormatting(),
          editor.isAllowLinks(), editor.isAllowStyles(), editor.isAllowImages());
}

And if you look into PrimeEnvironment you'll see that the property will be set if the class org.owasp.html.PolicyFactory is available on classpath:

htmlSanitizerAvailable = LangUtils.tryToLoadClassForName("org.owasp.html.PolicyFactory") != null

So you either:

  • update to PF 8
  • make sure that you don't have this class on the classpath
  • override the renderer and change/remove the code for the check
user_134185100
Related