Prompt Title and Description Sanitizes HTML Tags and Objects

Description

The HTML tags in the prompt Title and Description fields get sanitized and do not render in Strategy Web.

Steps to reproduce

1. Open the Strategy Web Admin page.
2. Click Security.
3. Under User Input Filtering, enable Prompt titles and descriptions.
4. Create a report.
5. Add a Category attribute.
6. Save the report as Report1.
7. Create an Attribute Element List prompt.
8. On the General tab, for Title and Instructions, enter the following HTML for the button object:
   

   
   <html>
   <p1>this is another test</p1>
   <input type="button" value="Click Me">
   </html>
   

   
   
9. Run the report.
10. The button does not appear on the Prompt page.

Why is this happening?

Starting in Strategy 2019, we implemented the OWASP Java HTML Sanitizer to encode the HTML used in prompt titles and instructions to enhance product security. Only the following HTML tags are supported in OWASP Java HTML Sanitizer:

• Common inline formatting
• Common block elements
• style
• image
• link
• table

Solution

Since this change was implemented to address possible security vulnerabilities, the use of HTML tags in the prompt Title and Description fields are not supported in Strategy 2019.