Question
Accenture
AU
Last activity: 3 Nov 2022 3:40 EDT
HTML rules have been deprecated and should be replaced with section rules.
While modifying this HTML fragment rule pyPublicDataPageWhiteList I have the above guardrail warning. Not sure how I should replace it with a section rule as this HTML fragment rule is only consists of allow-listed Data Pages (Pega Security Advisory D22 / E22 / F22 Vulnerabilities – Hotfix Matrix. | Support Center).
How do I justify the warning? Thanks
NCS Pte. Ltd
SG
Hi @alfin.putra: This is the recommended fixes for the mentioned security issue. It's fine to justify those guardrail.
Are you facing any issues while justifying the guardrails?
Thanks.
Updated: 2 Nov 2022 22:37 EDT
Accenture
AU
@ArulDevan no issue in justifying the warning, but I'm worried that the rule will be removed in the future. If this was the case, what impact would that have?
NCS Pte. Ltd
SG
Hi @alfin.putra: Got you.
If you worry about the rule deprecation in future release, ideally PEGA would do a alternative solution for this case ( either a different setup / mitigating the security risk in a different way)
As of 8.8, all applications to follow this. We need to wait for the impacts / fix in later version.
Thanks.
Accenture
AU
@ArulDevan so for now, because they mention to update the HTML fragment rule as recommended fix even though it is a deprecated rule, is it ok to leave it as it is and justify the warning?
NCS Pte. Ltd
SG
Hi @alfin.putra: Yes, you can proceed to justify the warning and continue using the recommended fix.
Thanks.