Posted by fl.schmitt(ops-users) on
URL: https://discuss.orbeon.com/RfE-Tagsoup-configuration-in-properties-local-xml-tp2550129.html

Hi all,

some months ago some mails on this ml dealt with html clean-up using the
TagSoup lib (see [1]). Currently, TagSoup not only creates valid XML,
but it' told to strip unknown elements ("bogons"), too: XFormsUtils.java
sets ignorebogonsfeature to true, suppressing "bogons" effectively [2].

This is ok regarding security matters, but the same step (purging the
HTML from unknown tags) is done twice, once by tagsoup and again by
clean-html.xsl. In scenarios where certain custom, non-HTML elements
should be allowed, the developer has to change both TagSoup and
clean-html.xsl. To change the tagSoup behaviour, either a modification
of the XFormsUtils.java source or the TagSoup source is required.

As an enhancement, i would propose:
- either change the tagSoup call just to create valid XML and let solely
clean-html.xsl decide which elements are valid (this means that
ignoreBogonsFeature should be set to false);
- or implement a way to configure tagSoup using properties in
properties-local.xml, so the user can decide if tagsoup should strip
unknown tags.

Personally, i would prefer the first option, but also the second one
would IMHO be a step forward.

It would be nice to hear some more opinions regarding this matter.

florian

[1]
http://wiki.orbeon.com/forms/doc/developer-guide/xforms-controls#TOC-HTML-cleanup
[2]
http://github.com/orbeon/orbeon-forms/blob/master/src/java/org/orbeon/oxf/xforms/XFormsUtils.java#L256


--
You receive this message as a subscriber of the [hidden email] mailing list.
To unsubscribe: mailto:[hidden email]
For general help: mailto:[hidden email]?subject=help
OW2 mailing lists service home page: http://www.ow2.org/wws