Question
SiXworks Limited
GB
Last activity: 19 Mar 2024 13:15 EDT
HTML Tags appearing
Hi We have a section where labels are required to have certain words highlighted bold and underlined for enthasis. However following a security update which invovled a DSS setting pyPreventXSSInLabel to true. HTML tags are now seen as literals to the business/end user (screenshot attached).
We have found a potential workarounds but wanted ask if anyone has used this DSS setting or anything similar. We have added this richtext mode script in the label value of the property which removes the tags but have some concerns if this is completely safe to implement.
Any additional insight would be very helpful.
Thanks Ant
Updated: 23 Jan 2024 6:56 EST
Pegasystems Inc.
GB
@AnthonyTham please can you specify the exact Pega version you have installed?
Can you also clarify what 'Security Update' you are referencing?
See details listed in the below support document:
Preventing risk of XSS attack when specifying Label controls [SDR-A71]
The DSS setting pyPreventXSSInLabel was introduced to prevent the risk of a cross-site scripting (XSS) attack when specifying Label controls.
If you are using Pega Platform version 8.7.4, you can disable Label formatting with HTML by setting the DSS: Owning Ruleset: Pega-UIEngine, Setting Purpose: pyPreventXSSInLabel, Value: true. However, this might pose a risk of XSS attack.
If you are using a Pega Platform version prior to Pega 8.8, it is recommended to update your deployment.
The issue was resolved in Pega Platform versions 8.4.4, 8.5.3, and 8.6 and later releases.
Updated: 5 Feb 2024 15:05 EST
Pegasystems Inc.
IN
@AnthonyTham We are sanitizing the HTML tags due to XSS attacks. The workaround that is applied is not a safer approach to have RichText in the labels. Hence, we don't recommend to have property reference tags in label values. Instead, this requirement of Bold and underline can be achieved through a non-autogenerated section or helper text or any other possible approach. But the current workaround that is applied is highly not recommended and it is a security comprise. Hope that helps. Thank you!
SiXworks Limited
GB
@chitv1 Helper text doesn't quite satisfy our requirement. Could you please show how the attached image form can be made achievable through non-autogenerated section or suggest any other possible approach to achieve this?
Thanks
Maantic
IN
Can you please try the same code by creating a field value and put the syntax in the field value.
Maantic Inc
IN
Creating a Field Value with pyCaption might be helpful in this scenario.
SiXworks Limited
GB
@SohamM95 @DebansuB the DDS setting pyPreventXSSInLabel prevents field values from reading HTML tags and will display them in the label.