encodeHtml Function Filter Data Input

5-68 Oracle Fusion Middleware System Administrators Guide for Oracle Content Server Multiple AttributeInfo entries can be added in a single row, separated by commas. For example, this entry adds two attributes into the AttributeInfo row: role,guest,15,account,\all,15. The following is an example of this ResultSet: ResultSet ExtUserAttribInfo 3 dUserName dApplication AttributeInfo jsmith appl role,contributor,15 jsmith app2 account,abc,15,account,xyz,15 end

5.9.3.2 Configuration Variable for ExtendedUserAttributes

The following configuration variable can be set in the Oracle Content Server system and is useful if you are working with default attributes: ■ DefaultAttributesCacheTimeoutInSeconds: Defines how long the default attribute cache remains active default = 600.

5.9.4 Filter Data Input

The Oracle Content Server system can be customized to filter data input for illegal or corruptive HTML constructs by using the encodeHtml Idoc Script function and a filter hook to automatically scrub all input data for dangerous HTML constructions. The encodeHtml function can be applied to a specific string. The HtmlDataInputFilterLevel configuration variable can be used to apply a level of encoding to filter all data input to the Oracle Content Server system. This section covers the following topics: ■ Section 5.9.4.1, encodeHtml Function ■ Section 5.9.4.2, HtmlDataInputFilterLevel Configuration Variable

5.9.4.1 encodeHtml Function

The encodeHtml Idoc function can be used to filter data input for illegal or corrupted HTML constructs. The output is an encoded string. The encodeHtml function is applied by default to the discussions in the Threaded Discussions component. The encodeHtml function is generally used at the exceptsafe or higher level of encoding because the HtmlDataInputFilterLevel configuration variable will already have been encoded as unsafe assuming it uses the default configuration. The encodeHtml function is defined as follows: encodeHtml string, rule, wordbreakrules ■ string : The string to encode. ■ rule : The rule to apply when encoding HTML constructs. The following values are allowed: – none: No conversion is done to HTML constructs. Managing Security and User Access 5-69 – unsafe: Only well-known unsafe script tags are encoded. The list includes: script, applet, object, html, body, head, form, input, select, option, textarea. – exceptsafe: Only well-known safe script tags are not encoded. The list includes: font, span, strong, p, b, i, br, a, img, hr, center, link, blockquote, bq, fn, note, tab, code, credit, del, dfn, em, h1, h2, h3, h4, h5, blink, s, small, sub, sup, tt, u, ins, kbd, q, person, samp, var, ul, li, math, over, left, right, text, above, below, bar, dot, ddot, hat, tilde, vec, sqrt, root, of, array, row, item. – lfexceptsafe: Recommended where extended comments are entered by a user and they want to preserve the line feed breaks of the original text. Similar to exceptsafe, however, line feed ASCII 10 characters are turned into HTML break tags br. Line feeds inside of HTML tags are not turned into break tags. The following script tags that are safe with exceptsafe are not safe with lfexceptsafe: br, p, ul, li. Except for the rule none, all the rules have special HTML comment handling. In particular, all HTML comments are allowed through the filter. However, when inside an HTML comment, all less than and greater than symbols are encoded. This does not apply to the HTML closing signature --. Also, if there is an unterminated comment, the encoding function appends the HTML comment close signature --. Additionally, except for the rule none, any attribute value located inside a tag has any parenthesis encoded to 28 for or 29 for . Otherwise, if any character is escaped it is escaped using the XML xxxx; type encoding. wordbreakrules : This is an optional parameter that specifies if long strings without space characters are to be broken up and what maximum word size to apply. Either the string wordbreak or nowordbreak can be specified. This parameter can be used with any of the encodeHtml rules. The default is to turn on wordbreak if the rule lfexceptsafe is specified, and to use a maxlinelength of 120 characters. The additional parameter maxlinelength=xxx can be used with the wordbreak parameter to specify a desired maximum line length. For example: encodeHtml exceptsafe, bad text, wordbreak, maxlinelength=80 The wordbreak functionality is only usable by the encodeHtml function because the function is used for display and not applied before the data is stored. For information about Idoc Script see the Oracle Fusion Middleware Idoc Script Reference Guide.

5.9.4.2 HtmlDataInputFilterLevel Configuration Variable