Need advice about server-side actions

Steven North swn at ocsystems.com
Fri Jul 1 21:47:38 UTC 2011


Thanks for the replies.

I realized after getting into this that I couldn't figure out how to get 
a message (in this case the URL) to be displayed from a script run as an 
alert sender/notification.  So I tried creating my own Alert plugin that 
can do the snapshot operation and display the URL in the Notification 
message field.

That works fine, except that the URL in that field cannot be copied and 
pasted anywhere!  Can this field be made copyable?

I also had a problem with the snapshot operation timing out.  I am using 
SupportManager.getSnapshotReport(), so there is not the usual option to 
supply a timeout that an ResourceOperationSchedule provides.  Is there 
any way to set a timeout, maybe at a global level?

Thanks in advance.

Steve


On 6/23/2011 9:38 AM, Ian Springer wrote:
> Note, currently when we cleanse values to prevent XSS attacks, we escape
> all HTML tags. Once we upgrade to GWT 2.2, in certain places (such as
> the alert info field) we will be able to instead use the new "safe HTML"
> APIs provided by GWT, which escape everything except certain HTML tags
> that are know to be "safe" (e.g.<b>,<i>,<h1>,<a>, etc.).
>
> I think the plan is to upgrade to GWT 2.2 soon.
>
> On 06/22/2011 05:30 PM, Ian Springer wrote:
>> On 06/22/2011 05:11 PM, Charles Crouch wrote:
>>> ----- Original Message -----
>>>> I think you have the right idea. But there is no way that I can think
>>>> of
>>>> to get that URL to show up in the UI as clickable link.
>>>>
>>>> The only thing I can think of is have the URL be output as part of the
>>>> server-side plugin operation (called "control"). The URL string would
>>>> appear in the results - but I don't think it would be clickable (since
>>>> I believe it gets rendered in a TextArea type GWT field).
>>> But that could potentially enhanced right Mazz? i.e. use a better widget that support clickable urls?
>> ConfigurationEditor.buildSimpleField() contains:
>>
>> if (propertyIsReadOnly&&   propertyDefinitionSimple.getType() !=
>> PropertySimpleType.PASSWORD) {
>>                valueItem = new StaticTextItem();
>> }
>>
>> (propertyIsReadOnly would be true for all properties in an operation
>> results Configuration)
>>
>> By default, StaticTextItems will not escape any HTML in their values.
>> However, further down in buildSimpleField(), we explicitly escape the
>> value due to security concerns:
>>
>>            String value = propertySimple.getStringValue();
>>            if (valueItem instanceof StaticTextItem) {
>>                // Property values are user-editable, so escape HTML when
>> displayed as static text, to prevent XSS attacks.
>>                value = StringUtility.escapeHtml(value);
>>            }
>>            valueItem.setValue(value);
>>
>> If we decide that there are some cases, such as operation results, where
>> we always trust property values in a Configuration to not contain
>> malicious HTML, then we could easily add a new option to the
>> ConfigurationEditor, e.g.:
>>
>> configurationEditor.setEscapeHtmlInPropertyValues(false);
>>
>> and then change the code in buildSimpleField() to:
>>
>> if (valueItem instanceof StaticTextItem&&   isEscapeHtmlInPropertyValues()) {
>>       ...
>>
>>
>>
>>>> You'd have to
>>>> cut-n-paste into the browser.
>> _______________________________________________
>> rhq-devel mailing list
>> rhq-devel at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/rhq-devel
>



More information about the rhq-devel mailing list