I need to insert contentNote record from apex rest api. Below is the sample code
`ContentNote noteRecord = new ContentNote();
noteRecord.Title = 'Title';
String body = restJSONdata.get('content');
noteRecord.Content = Blob.valueOf(body.escapeHTML4());
insert noteRecord;`
`ContentDocumentLink link = new ContentDocumentLink();
link.ContentDocumentId = noteRecord.id;
link.LinkedEntityId = '0015h00001brgJq';
link.ShareType = 'V';
link.Visibility = 'AllUsers';
insert link;`
here restJSONdata is json map received in request body and value of content in request body will have some html content like this "content":"<b>Some text</b>"
.Since I am using escapeHTML4() the final content that gets stored doesnt hold rich text formatting and instead of saving the text as bold, it saves it along with the html tags like this <b>Some text</b>
.
Is there any way I can retain rich text format without compromising with cross site scripting?
When I use the code as below, it does saves the formatting but doesnt takes care of xss attack .
contentNote.Content = Blob.valueOf(body);
I checked by adding a input text and a rich text output in vf page. The rich text displays the content of what the user inputs in the input text. When I enter <b>someText</b>
, the rich text output shows content in bold. but when I add something like this <b>text 1</b><script>alert(0);</script><b>Text2</b>
, it shows text 1 and text 2 in bold, ignoring the script tag that is there in between the two text. It seems to me may be Salesforce has out of the box mechanism to take care of xss attack when its rich text format but I can not find formal documentation for same.