Question
Pegasystems Inc.
DE
Last activity: 28 Oct 2024 12:35 EDT
Wiki Syntax - URL syntax is not resolved
Hello,
We upgraded to Pega Platform version: 24.1.1. When I use the Wiki Syntax for URL in Pulse like this:
[Text](Link) - It doesn't matter whether or not I leave a blank character between ](
After the user clicks the "Save" button for posting the note the URL syntax is not resolved properly. The corresponding HTML looks like this:
<p>[Text](<a href="Link" target="_blank">[Link]</a>)</p>
We also have Pega Platform 8.8.4 in which the same Wiki Syntax for URL generates the correct HTML:
<p><a href="(Link)" target="_blank">[Text]</a></p>
From my understanding the HTML in Version 24.1.1 is generated wrongly. Does anyone already experience this issue and if yes, is this already addressed?
Best regards,
Tadeusz
Accepted Solution
Updated: 28 Oct 2024 12:35 EDT
Pegasystems Inc.
GB
@Tadeusz Malek Your understanding is correct, and it is simply a change in product behaviour. Going forward pulse note will not support "Docs" markdown due to we added crossScriptingFilter function to sanitize HTML/JavaScript code injection to avoid security issue. So this limitation was updated in support document.
Also replacing pulse note text area with RTE is not recommended design solution since it requires enormous design level change not a straight forward one.
Details:
The pyPostTextParser is an available rule if you wanted to remove the crossScriptingFilter change. This would re-introduce the security vulnerability so is not recommended.
Workaround:
@Tadeusz Malek Your understanding is correct, and it is simply a change in product behaviour. Going forward pulse note will not support "Docs" markdown due to we added crossScriptingFilter function to sanitize HTML/JavaScript code injection to avoid security issue. So this limitation was updated in support document.
Also replacing pulse note text area with RTE is not recommended design solution since it requires enormous design level change not a straight forward one.
Details:
The pyPostTextParser is an available rule if you wanted to remove the crossScriptingFilter change. This would re-introduce the security vulnerability so is not recommended.
Workaround:
- Save as the activity pyPostTextParser (CL: PegaSocial-Message RS: Pega-Social:08-08-03) into your application ruleset.
- Remove the line number 16 from Java step number 11. (i.e. postText= StringUtils.crossScriptingFilter(postText); // Remove this line alone).
- Save and check-in the rule to use Docs markdown.
A number of bug items were spun off to update the instructions in the 'Formatting help' icon, update the documentation, and add the cross site scripting filter for the Constellation applications. The 8.8.5 patch was the final patch release for the 8.8 version. The bug items spun off for the Infinity '23 and '24 patch releases were to amend the documentation to show the limitation. Here are the bug references.
BUG-878186,BUG-878185,BUG-878184 -BUG reference for Removing 'Links' markdown info under 'Formatting help' icon. Links markdown will be no more supported in pulse ,we raised documentation BUG too to handle the same to update in helper document, which is what you already found via your GenAI Buddy search answer.
BUG-877574,BUG-877573,BUG-877572- XSS has to be added from constellation side as well. Post adding the xss function , Links markdown will not support for constellation as well.
Updated: 14 Oct 2024 4:46 EDT
Pegasystems Inc.
DE
I searched within the My Support Portal and with the help Pega GenAI Buddy I found this documentation page:
The documentation has this note:
"After you submit your post, Pulse formats the text automatically using markdown syntax. If you use unsupported markdown syntax, the editor does not report any errors and renders the text as is."
Thus, from my understanding of the reading in this documentation the Link as markdown isn't there in Version 24.1 and the URL of the link is just displayed.
Look at the attachment of the corresponding documentation.
Can someone comment on this if this my correct understanding?
Accepted Solution
Updated: 28 Oct 2024 12:35 EDT
Pegasystems Inc.
GB
@Tadeusz Malek Your understanding is correct, and it is simply a change in product behaviour. Going forward pulse note will not support "Docs" markdown due to we added crossScriptingFilter function to sanitize HTML/JavaScript code injection to avoid security issue. So this limitation was updated in support document.
Also replacing pulse note text area with RTE is not recommended design solution since it requires enormous design level change not a straight forward one.
Details:
The pyPostTextParser is an available rule if you wanted to remove the crossScriptingFilter change. This would re-introduce the security vulnerability so is not recommended.
Workaround:
@Tadeusz Malek Your understanding is correct, and it is simply a change in product behaviour. Going forward pulse note will not support "Docs" markdown due to we added crossScriptingFilter function to sanitize HTML/JavaScript code injection to avoid security issue. So this limitation was updated in support document.
Also replacing pulse note text area with RTE is not recommended design solution since it requires enormous design level change not a straight forward one.
Details:
The pyPostTextParser is an available rule if you wanted to remove the crossScriptingFilter change. This would re-introduce the security vulnerability so is not recommended.
Workaround:
- Save as the activity pyPostTextParser (CL: PegaSocial-Message RS: Pega-Social:08-08-03) into your application ruleset.
- Remove the line number 16 from Java step number 11. (i.e. postText= StringUtils.crossScriptingFilter(postText); // Remove this line alone).
- Save and check-in the rule to use Docs markdown.
A number of bug items were spun off to update the instructions in the 'Formatting help' icon, update the documentation, and add the cross site scripting filter for the Constellation applications. The 8.8.5 patch was the final patch release for the 8.8 version. The bug items spun off for the Infinity '23 and '24 patch releases were to amend the documentation to show the limitation. Here are the bug references.
BUG-878186,BUG-878185,BUG-878184 -BUG reference for Removing 'Links' markdown info under 'Formatting help' icon. Links markdown will be no more supported in pulse ,we raised documentation BUG too to handle the same to update in helper document, which is what you already found via your GenAI Buddy search answer.
BUG-877574,BUG-877573,BUG-877572- XSS has to be added from constellation side as well. Post adding the xss function , Links markdown will not support for constellation as well.