Welcome toVigges Developer Community-Open, Learning,Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
1.3k views
in Technique[技术] by (71.8m points)

jsf - Displaying HTML from DB in <h:outputText escape="false"> results in broken HTML page

Is there any way to setup Firefox and Chrome to work with escape=false attribute in h:outputText tag. When there is some html that needs to be shown in the browser, Firefox and Chrome show parsed string correctly, but any other links in application are freezed (??).

The example html from db:

<HEAD>
<BASE href="http://"><META content="text/html; charset=utf-8" http-equiv=Content-Type>          
<LINK rel=stylesheet type=text/css href=""><META name=GENERATOR content="MSHTML 9.00.8112.16434">
</HEAD>
<BODY><FONT color=#000000 size=2 face="Segoe UI">l?uft nicht</FONT></BODY>

Parsed HTML on the page:

l?uft nicht

What is very weird, is that in IE everything works (usually it is opposite).

I use primefaces components (v2.2), .xhtml, tomcat 7 and JSF 2.0

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Answer

0 votes
by (71.8m points)

You end up with syntactically invalid HTML this way:

<html>
    <head></head>
    <body>
        <head></head>
        <body>...</body>
    </body>
</html>

This is not right. There can be only one <head> and <body>. The browsers will behave unspecified. You need to remove the entire <head> and the wrapping <body> from that HTML so that you end up with only

<FONT color=#000000 size=2 face="Segoe UI">l?uft nicht</FONT>

You'd need to either update the DB to remove unnecessary HTML, or to use Jsoup to parse this piece out on a per-request basis something like as follows:

String bodyContent = Jsoup.parse(htmlFromDB).body().html();
// ...

Alternatively, you could also display it inside a HTML <iframe> instead with help of a servlet. E.g.

<iframe src="htmlFromDBServlet?id=123"></iframe>

Unrelated to the concrete problem:

  1. Storing HTML in a DB is a terrible design.
  2. If the HTML originates from user-controlled input, you've a huge XSS attack hole this way.
  3. The <font> tag is deprecated since 1998.

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome to Vigges Developer Community for programmer and developer-Open, Learning and Share
...