allow-html="safe" Meaning

[dhiraj.g]

Hi ,
Why we uesd  allow-html="safe" in service.

Thanks
Dhiraj Gupta

[Paul Foxworthy]

Hi Dhiraj,

OFBiz uses AntiSamy from the Open Web Application Security Project (OWASP). See https://www.owasp.org/index.php/AntiSamy for an introduction. AntiSamy filters incoming data to prevent cross site scripting (XSS) attacks.

The allow-html setting can be set to "none" to prevent any HTML input to a service, "safe" to allow limited HTML content but deny dangerous content such as script, or "any".

I hope that helps.

Cheers

Paul Foxworthy

dhiraj.g wrote

Hi ,
Why we uesd  allow-html="safe" in service.

Thanks
Dhiraj Gupta