Submit Feedback
Knowledge Base
Published Jul. 2, 2025

Protecting Against Bootstrap CVE-2019-8331 via AntiSamy Sanitizer

Written By

Roberto Díaz

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Issue

  • Liferay DXP 7.0 uses a Bootstrap version which, under certain configurations, is susceptible to the following Cross-Site Scripting (XSS) vulnerabilities:

Environment

  • Liferay DXP 7.0

Resolution

To protect the portal against these vulnerabilities, ensure the Liferay AntiSamy Sanitizer is activated to filter malicious content. While most portlets are whitelisted by default, you must deactivate the whitelist exception for Web Content to ensure full protection.

  1. Navigate to Control Panel > Configuration > System Settings > Foundation > AntiSamy Sanitizer.

  2. Remove com.liferay.journal.model.JournalArticle from the Whitelist field.

    1. If this is not present, AntiSamy is already activated for this type of content.

  3. Click Save. The Web Content portlets will now sanitize XSS before publication.

  4. Re-publish any existing content to apply the sanitization.

    1. Note: This process will automatically modify the republished content if it contains restricted elements that must be sanitized.

Additional Information

Did this article resolve your issue ?
Knowledge Base
Did this article resolve your issue ?