KB483611: Configure the white list for HTML in MicroStrategy Web for prompt title and description

Strategy Web allows HTML output in Prompt titles and descriptions. Before Strategy 11.0 release, users could insert any HTML to the prompt title and description. Starting with version 11.0 Strategy uses OWASP-Java-Html-Sanitizer to smartly encode instead of not encoding at all. This change was introduced to tighten Strategy security standards. Some elements and attributes like

<a target=“popup”>

will be filtered by OWASP-Java-Html-Sanitizer due to security concerns.
The original html:
<a href="https:\\Google.com" target="blank_">
After sanitized by OWASP-Java-Html-Sanitizer:
<a href="https:\\Google.com" rel="nofollow">
In order to allow customers to use some HTML elements and attributes, the white list setting has been exposed beginning with Strategy 2019 update 3 (11.1.3).
 

Configuration

Step 1

Go to

<MSTR Web> \WEB-INF\xml

folder and add v="WEB-INF/xml/htmlSanitizerConfig.json” to the

sys_defaults.xml

file in following syntax:
 

<pr des="A fast and easy to configure HTML Sanitizer which lets you include HTML while protecting against XSS." n="htmlSanitizerFileLocation" scp="system" v="WEB-INF/xml/htmlSanitizerConfig.json"/>

Step 2

Go to

<MSTR Web> \WEB-INF\xml

and add the customized sanitizer policies to the 

htmlSanitizerConfig.json

file
For example:

[
    {
        "allowElements": ["a"],
        "allowAttributesObject": {
            "allowAttributes": ["target", "onclick"],
            "onElements": ["a"],
            "globally": false
        }
    }
]

Administrator users can add the element and attribute of HTML in the

htmlSanitizerConfig.json

to allow them.

• "allowElements"

  : Allows the named elements.

• "allowAttributesObject"

  : Returns an object that lets you associate policies with the given attributes, and allow them globally or on specific elements.

• "globally"

   and

  "onElements"

  : To allow the attribute for all elements, set

  globally: true

  . Otherwise input the elements inside

  "onElements":.

• "allowTextIn"

  : Allows text content in the named elements.

• "allowWithoutAttributes"

  : Assuming the given elements are allowed, allows them to appear without attributes.

Below are some examples for

htmlSanitizerConfig.json

 content.
Example 1
Allow attribute

“target”

only in tag “a”

:

<a href='http://outside.org/' target=\"blank_\">out</a>

.
[
    {
        "allowElements": ["a"],
        "allowAttributesObject": {
            "allowAttributes": ["target"],
            "onElements": ["a"],
            "globally": false
        }
}
]
Example 2
Allow text in tag

“script”: <script> xxx </script>

[
    {
        "allowElements": ["script"],
        "allowTextIn": ["script"]
}
]
Example 3
Allow empty tag

“span”

without any attributes:

<span></span>

 
[
    {
        "allowElements": ["span"],
        "allowWithoutAttributes": ["span"]
    }
]
Example 4
Allow  the

“class”

attribute on any elements globally.
 
[
    {
       "allowAttributesObject": {
            "allowAttributes": ["class"],
            "onElements": [""],
            "globally": true
        }
    }
]
Example 5
Allow multiple elements or attributes.
 
[
    {
       "allowAttributesObject": {
            "allowAttributes": ["align", "valign"],
            "onElements": ["table", "tr", "td", "th"],
            "globally": false
        }
    }
]
 

 Step 3

Restart Web Server.