Testing ODBC connectivity

Description

Strategy Web allows HTML output on selectors. Prior to Strategy 2021 Update 3, you could insert any HTML to the selector. Starting in Strategy 2021 Update 3, OWASP-Java-Html-Sanitizer is used to smartly encode, instead of not encoding at all. This change is introduced to tighten Strategy security standards. Some elements and attributes like

<target=“popup”>

will be filtered by OWASP-Java-Html-Sanitizer due to security concerns.
To allow the use of some HTML elements and attributes, the whitelist setting is exposed starting in Strategy 2021 Update 3. 

How to allow HTML on a selector

1. Go to the 

   <MSTR WEB>\WEB_INF\xml

   folder.
2. Open

   sys_defaults.properties

    If it does not exist, create one. 
3. Add the following setting: 
   

   
   allowHTMLOnSelector=1 

   
   
4. Restart the Web server.

How to configure the whitelist for HTML output on a selector

1. Go to the 

   <MSTR WEB>\WEB_INF\xml

   folder.
2. Open

   sys_defaults.properties

    If it does not exist, create one. 
3. Add the following setting: 
   

   
   htmlSanitizerFileLocation=WEB-INF/xml/htmlSanitizerConfig.json 

   
   
4. In the same

   <MSTR WEB>\WEB_INF\xml

   folder, add the customized sanitizer policies to the

   htmlSanitizerConfig.json

   file.
   By default, common styles such as "color" and "font" is allowed for CSS styles. To allow additional styles, you can add them in

   htmlSanitizerConfig.json

   . For example:
   

   
    
   
       { 
   
           "allowStyling": [ 
   
               "display" 
   
           ] 
   
        } 
   
   ]  

   
   Administrator users can also add the element and attribute of the HTML in

   htmlSanitizerConfig.json

   to allow them.
   

   
    
   [ 
   
       { 
   
           "allowElements": ["a"], 
   
           "allowAttributesObject": { 
   
               "allowAttributes": ["target", "onclick"], 
   
               "onElements": ["a"], 
   
               "globally": false 
   
           } 
   
       } 
   
   ]   

   
   Where:
   

• “allowStyling”

  : Allows the named CSS styling.

• "allowElements"

  : Allows the named elements.

• "allowAttributesObject"

  : Returns an object that lets you associate policies with the given attributes, and allow them globally or on specific elements.

• "globally"

  and

  "onElements"

  : Allows the attribute for all elements- set

  "globally": true

  . Otherwise, input the elements inside

  "onElements".

• "allowTextIn"

  : Allows text content in the named elements.

• "allowWithoutAttributes"

  : Assuming the given elements are allowed, allows them to appear without attributes.
5. The following are some examples for

   htmlSanitizerConfig.json

   content.
   
   Example 1
   Allow empty tag

   "span"

   without any attributes:

   <span></span>

   
   

   
   [ 
       { 
           "allowElements": ["span"], 
           "allowWithoutAttributes": ["span"] 
       } 
   ] 

   
   
   Example 2
   Allow the

   "class"

   attribute on any elements globally.
   

   
   [ 
       { 
          "allowAttributesObject": { 
               "allowAttributes": ["class"], 
               "onElements": [""], 
               "globally": true 
           } 
       } 
   ] 

   
   
6. Restart the Web server.