1

We have developed a Managed Grid component where users can dynamically pass column definition and data which will be rendered as SLDS table. We support datatypes such as Text,Date,DateTime.. so on.

We are considering supporting RichTextArea type based on some of our client's feedback. Since we will need to show the HTML content in a column, Our question is:

Do we need to sanitize the HTML content that is passed to the component? If Yes, Are there any Salesforce/Locker Service approved libraries available out to strip out problematic tags like script,.. and return proper content?

Improve this question

1 Answer 1

Reset to default
1

If the markup is stored in your org as an entity field, it should have already been sanitized before storing by our api layer. When it comes to the UI, any attempt to set innerHTML on a node and such will be sanitized by LockerService. We use DOMPurify for sanitizing the markup.

Just a suggestion, have you thought about using the standard lightning components that support RTE? Like lightning:inputRichText for example https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/aura_compref_lightning_inputRichText.htm You could use the lightning:outputField to display the data and it dynamically chooses the lightning:outputXX type based on your field type.

Improve this answer
6
  • Source of the RichText data can be from SF/3rd party API provider as well. We'll be doing innerHTML way rather than using lightning components at the moment. Since Locker does the sanitization work for us, so we are fine right?
    – Praveen
    Commented Oct 19, 2017 at 5:16
  • 2
    innerHTML is sanitized. You are good to go. github.com/forcedotcom/aura/blob/…
    – Ravi Jayaramappa
    Commented Oct 19, 2017 at 14:31
  • 2
    Getting error: Uncaught TypeError: Failed to execute 'createNodeIterator' on 'Document': parameter 1 is not of type 'Node'. using DOMPurify, any suggestions?
    – Aequitas
    Commented Aug 3, 2018 at 6:03
  • @Aequitas Thanks for the detailed error message. It looks like locker service is not handling the arguments sent to createNodeIterator() correctly. I have logged an issue for us to fix that W-5284583
    – Ravi Jayaramappa
    Commented Aug 3, 2018 at 17:54
  • @RaviJayaramappa Any updates on this fix? I am getting same issue when passing in a string without any special characters using DOMPurify.sanitize method
    – Eduardo La Hoz Miranda
    Commented Aug 28, 2019 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .