Issue
- When adding the notes:// protocol to a link in Knowledge Base, AntiSamy removes it and displays it as text.
Environment
- Liferay DXP 7.2, 7.3
Resolution
By default, everything is sanitized by AntiSamy, with 3 exceptions (JournalArticle, BlogsEntry and FragmentEntry).
Knowledge base is not among those exceptions so all your content will be sanitized by AntiSamy, which detects <other> protocols as insecure and removes them to avoid security problems.
- There are two different options:
- Whitelist: AntiSamy uses a whitelist, so it can define subsets of entities that should not be disinfected, preventing content of that type from being filtered.
-
Sanitizer-configuration.xml: A less restrictive option would be to add the desired protocol to the Sanitizer-configuration.xml file. In this way, AntiSamy will still perform the cleaning but will accept the added protocol as valid.
- To add the required protocol, the regular expression that allows filtering of external URLs <regexp name="offsiteURL"> must be modified.
- You can change this regular expression following the steps detailed in the following document, How to configure validation directives in AntiSamy.