2

When I try to ant deploy ("Force.com Migration tool") to one of our sandboxes I get the following error message:

email/folder/sometemplate.email -- Error: Your template contains active content, which can't be verfied as safe.

I've never seen this error message before. The template has existed in production for a long time without deployment issues. The template doesn't contain any scripting, but does contain hyperlinks and email addresses (mailto:...)

Is this a new security feature of Spring 16? Is there an associated setting anywhere? Is there any documentation?

2
  • what does "sometemplate.email" look like? Is it just a regular vanilla email template, or is there something funky being done with it?
    – pchittum
    Commented Jan 11, 2016 at 15:53
  • I've checked. It's an HTML template. Can't see anything funky other than hrefs and mailtos. Which should be OK, right? It's also specific to only one sandbox. All other sandboxes accept the deployment. (And all sandboxes are now on Spring 16)
    – powlo
    Commented Jan 11, 2016 at 16:06

3 Answers 3

3

We are seeing the same issue, I think this is probably related to this:

Email Templates and Letterheads No Longer Support Scripts

To protect email recipients from potentially dangerous HTML content, Salesforce now applies a filter to prevent any active scripts from being included in letterheads and email templates. This feature is available in Salesforce Classic only.

Source - http://docs.releasenotes.salesforce.com/en-us/spring16/release-notes/rn_general_email_template_letterhead_content.htm

I've opened a Salesforce case to find more information, I'll update if they provide any useful information.

Update 2016/01/22: Support have advised that there is a known issue and that this has now been deployed to most sandbox instances: https://success.salesforce.com/issues_view?id=a1p300000008cXCAAY

Update 2016/01/14: Support have directed me to this kb article (000231900):

Your template contains active content, which can't be verified as safe.

Spring '16 introduces new security around email templates to reduce the risk of potentially malicious scripts being included in HTML in email templates. Salesforce have whitelisted all common and known tags but some none conventional tags may stop the editing of the template through the GUI. This prompt can also affect Change Set actions that access the templates.

Currently some none conventional tags such as cause the security prompt to invoke. This tag and any other common none malicious codes that are identified in regular use will be exempted from invoking the new security prompt in the near future.

Users can inspect their templates by running SOQL queries similar to SELECT HtmlValue,Id FROM EmailTemplate WHERE Id = '00XQ0000000XXXX'. Using a tool such as Workbench (https://workbench.developerforce.com/login.php) the Html can be edited and updated to remove any problem tags to allow editing of the template.

The new security features does not stop the use of existing templates in emails by users. The security prompt only applies to Letterheads and HTML Email Templates. The prompt doesn't invoke for Custom Templates as these are already protected from malicious scripts.

Source: https://help.salesforce.com/apex/HTViewSolution?urlname=Your-template-contains-active-content-which-can-t-be-verified-as-safe&language=en_US

1
2

We started experiencing the same issue after the upgrade to Spring '16 due to this security enhancement

Here is the answer from SFDC support for my particular case:

"...we found that there is an odd markup “office Namespace” which may be the reason for the error.

To fix the issue, modify the code to replace the <o:p></o:p> with <p></p>"

1
  • Actually, it's better to strip out the <o:p> tags completely, since it seems the template renderer ignores them. If you replace with <p> you'll get extra paragraphs.
    – powlo
    Commented Jan 15, 2016 at 13:56
0

We faced this issue when attempting to use change sets to deploy HTML templates containing tables. We were able to get around it by deploying them via Eclipse instead.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .