Certification How to Use sanitization?

[IraJWatt]

Hi,

As part of the certification process there is a requirement to: "ensure DOM is manipulated safely. Use sanitization for user input or user data, before adding it to DOM."

How have others achived this?

I have implemented the code below to loop through all the data from the user and apply a sanitizeHTML function on it. I am not sure if this is enough.

  options.dataViews[0].table.rows = options.dataViews[0].table.rows.map(innerArray =>
            innerArray.map(element => {if (element) { return sanitizeHtml(String(element)); } else return null }));

[dm-p · Accepted solution]

Hi @IraJWatt,

If you're using sanitize-html, this should be enough. However, you may need to consider the permitted tags your HTML may contain to avoid arbitrary execution of JavaScript and potential attempts to load data remotely via attributes like src. For the remote loading, setting your WebAccess privilege in your capabilities as directed should prevent this, but you can also manage this within sanitize-html.

If it helps, the HTML Content visual is open source. There is a version called HTML Content (lite), certified by MS, so it can be regarded as good enough for HTML sanitization in a certified environment. You can review its sanitize-html configuration here.

Good luck!

Daniel