How to display custom HTML in my Visualforce Page

Question

I created a visualforce page, and i get some data(HTML) from webservice and store it in Custom Object as LongText, When i retrieve it and display in my visual force page something like this

<apex:outputText value = "{!myobjdata}" escape=false/>

It works fine, But when i give my application for the review, Then the Security Scanner gives error with above line and SELECT query of my object in class file (XSS_STORED)

Then I read about this XSS, and I added my data to visualforce page as below

<apex:outputText value = "{!HTMLENCODE(myobjdata)}" escape=false/>

But, now the data(HTML) in my object shows as it is like

<div><ul>someinfo<li>point1</li><li>point2</li></ul></div>

in my visualforce page The HTML content is not rendered, How can i Overcome these issues (Mainly XSS)

Please help

Answer 1

If you want to render HTML from an Apex Controller into a component unescaped you need to make sure that there is no active content, otherwise you will have a stored cross site scripting vulnerability. Currently the only (sane) way to do this is to pull the HTML from a rich text field. This will sanitize the html and make it safe for rendering via an escape='false' attribute.

The scanner will still complain because the scanner doesn't know about data types. That's fine, it's a false positive, and you will always get false positives. It wont cause trouble for you in the security review -- just make a note that this is coming from a Rich Text Field and so is safe to render unescaped.

So the real issue is whether the html is safe to render or not. If it's safe, then ignore the scanner, if it's not safe, you need to make it safe by storing it in a rich text field and then pulling it back out.

If it's not safe, and you try to trick the scanner by first encoding and then unencoding before rendering, then you will succeed in both tricking the scanner and inserting a vulnerability into your application, violating the Master Services Agreement that you signed, and compromising the security of anyone using this code.

The scanner is a tool meant to help you by pointing out possible issues in your code, but what matters is the actual security of your code.

Answer 2

A solution I have used before is to load the HTML content into a JavaScript variable and then use JQuery (or standard JavaScript) to insert the 'text' into the DOM structure in the correct place.

I think I did something like:-

var htmlInject = '{!HTMLENCODE(myobjdata)}';
//replace any escaped chars as necessary...
    $("mynode").html(htmlInject);