2

I know JavaScript or CSS won't work in the SalesForce HTML editor. But I have tried these:

  1. I put JavaScript and HTML both in HTML editor. (JavaScript got deleted automatically and it didn't work.)

  2. I tried putting the same JavaScript and HTML in the template HTML. (It works.)

  3. So, finally I tried putting the HTML part in HTML editor and JavaScript function in template HTML. Logically it should work. It still doesn't seem to be working. I don't know why.

Is there a way to add some JavaScript functions to the SalesForce HTML editor included in rich text editor? I really need to add some functions.

2
  • Are you attempting to get JavaScript injected into a standard Salesforce page by including the markup in a rich text field or is this in a VF page?
    – Mark Pond
    Commented Jun 22, 2015 at 23:34
  • Well I'm trying to implement a knowledge article on my Site.com page. "JavaScript or CSS is treated as text. For example, if you're creating an Idea through the API, any JavaScript or CSS code is removed without warning." So, I tried to put my javascript code in site.com template but doesn't seem like it's working.
    – H.M.W
    Commented Jun 23, 2015 at 14:39

2 Answers 2

2

No, the design requirements of a rich text field is to include only html mark up and strip away active content such as javascript. All JS event handlers are removed and only a whitelisted set of tags and attributes are allowed. Remember that rich text field text output should be rendered with an escape="false" flag to avoid double rendering. If JS could be included, that would be a stored XSS vulnerability. This is because Author Apex (a profile-level permission) is required to add code to a Salesforce organization, whereas different permissions control access to sObject fields.

In general, the platform does not support the storing and subsequent execution of Javascript code in any sObject field, including rich text fields and URL types (you cannot include a javascript: pseudo-scheme in URL fields, either). If you want to store and run JS code and you have author apex, then put your code in a Visualforce page, Lightning component controller or renderer, or in static resources loaded by your VF page or lightning component. You can also put Javascript into custom button handlers that you create. But you wont be able to execute code just by updating the contents of sObjects.

You could intentionally write a vulnerable visualforce page that has a mergefield that is not properly escaped. For example:

<script>
{!my_field}
</script>

But hopefully whoever is in charge of security for your organization would flag this as a cross site scripting vulnerability. Please don't do this, and maintain the separation of code and data in your own code in order to keep your Salesforce organization secure.

0

If you are using Site.com, did you try one of the methods listed on this article? https://help.salesforce.com/HTViewHelpDoc?id=siteforce_code_custom.htm&language=en_US

You should be able to add Javascript to the page or template, but you will not be able to put that code in the knowledge article itself. Javascript in the article itself would be a very bad security concern, which is why Salesforce converts it to text for you.

2
  • Thanks, I did try. I just want to add some functions to some div in the article. It works perfectly in the template but the article seems to be blocking the javascripts.
    – H.M.W
    Commented Jun 23, 2015 at 19:56
  • Does a basic javascript command work? Are you getting any errors in your browser console? Since you are using jQuery you may need to assign your script to avoid conflicts with .noConflict() and/or reassign the $ variable.
    – CyberJus
    Commented Jun 26, 2015 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .