KB485089: How to customize the CSRF message displayed using MicroStrategy Web SDK 2021

Description 

In Strategy Web, to prevent a CSRF attack, you can enable

validateRandNum

in the

sys_defaults.xml

file by changing its value to 1. This setting appends a dynamic token to each request made that is unique to the user session. As a result, if a link is opened without a valid token, an error is returned.
For more information on CSRF settings, refer to Prevent a CSRF Attack .
This customization overrides the CSRF page implementation to apply custom tags and update the page xml. 

• Using the Web Customization Editor, create a new class which extends the

  CSRFConfirmationPageComponentImpl

  class. 
  

• Override the

  getPageSource

  method provided by

  CSRFConfirmationPageComponentImpl.

• Within this method, create a new

  TagsFactory

  instance:
  

  
  TagsFactory tf = TagsFactory.getInstance();
  

  
  For more information on TagsFactory, see the Web Reference API .
  
• Create a set of tags to be added to the page:
  

  
  Tag messageDiv = (Tag) tf.newTag(EnumHTMLTags.TAG_NAME_DIV);

  
  
• Render the parent tag as a

  MarkupOutput

  :
  

  
  MarkupOutput tempOut = WebBeanFactory.getInstance().newMarkupOutput();
  messageDiv.render(tempOut);
  

  
  
• Convert the rendered

  MarkupOut

  to a string and return it:
  

  
  String finalStringOutput  =  tempOut.getCopyAsString();

  
  

An example of the custom class may look similar to the following:

public class CSRF_Update_HREF extends CSRFConfirmationPageComponentImpl {
	public CSRF_Update_HREF() {
		super();
	}
	
	@Override
	public String getPageSource() {
		String originalMessage = super.getPageSource();
		
		// Using TagsFactory https://www2.Strategy.com/producthelp/Current/WebAPIReference/com/MicroStrategy/web/tags/TagsFactory.html
		TagsFactory tf = TagsFactory.getInstance();  
		Tag messageDiv = (Tag) tf.newTag(EnumHTMLTags.TAG_NAME_DIV);
		
		// Create a new <span> tag which holds custom text
		Tag spanContent = (Tag) tf.newTag(EnumHTMLTags.TAG_NAME_SPAN);
		spanContent.addTextChild("This is a CSRF Error please click the link.");
		messageDiv.addChild(spanContent); // Add <span> text to the return div
		
		// Current path, ex: http://sup-002222.labs.Strategy.com:8080/MicroStrategy/servlet/mstrWeb
		String currentPath =  getAppContext().getServletPath();

		// Create a new <a> tag
		AnchorTag anchortag = tf.newAnchorTag();
	    anchortag.setAttribute("href", "http://www.google.com");
	    anchortag.setAttribute("target", "_blank");
	    anchortag.addTextChild(currentPath); // This provides the text for the anchor tag
		
	    messageDiv.addChild(anchortag); // A new <a> tag to return <div>

	    MarkupOutput tempOut = WebBeanFactory.getInstance().newMarkupOutput();
	    messageDiv.render(tempOut);
	    
	    String finalStringOutput  = tempOut.getCopyAsString();
		return finalStringOutput;
	}
}

To overwrite the existing page class with the custom one, you need to update the

pageConfig.xml

file to point to the new source. 

1. Create a copy of the

   pageConfig.xml

   file (located at

   /WEB-INF/xml/pageConfig.xml

   ) and place it in your plugin at the same location (

   [plugin_name]/WEB-INF/xml/pageConfig.xml

   ).
2. Add the following context to apply the customization:
   

   
   <framework>
     <pages>
       <page name="CSRFConfirmation" class="customclasses.components.CustomCSRFConfirmationPageComponentImpl" >
       </page>
     </pages>
   </framework>
   

   
   

The example provided in this article is provided “as-is” to the user and assumes that the user:

• Can program, compile (e.g., javac, jikes, etc.), and execute Java programs
• Can configure environment variables (e.g., JAR files, property files, etc.)
• Have all the necessary tools to create Java applications (JDK, IDE, etc.)
• Has access to the Strategy SDK documentation
• Has read the customization warning at the bottom of this article

CUSTOMIZATION WARNING:

This customization is provided as a convenience to Strategy users and is only directly applicable to the version stated. While this code may apply to other releases directly, Strategy Technical Support makes no guarantees that the code provided will apply to any future or previous builds. In the event of a code change in future builds, Strategy Technical Support makes no guarantee that an updated version of this particular customization will be provided. In the event of a code change in future builds, Strategy may not be able to provide additional code on this matter even though this customization is provided at this time for this specific build. For enhancements to this customization or to incorporate similar functionality into other versions, contact your Account Executive to inquire about Strategy Consulting assistance.