Issue
1. When the below content is pasted in the source of Web Content, then the onclick event gets removed from the source automatically.
Below is the original content:
<div class="Small-ButtonRSecond"><button class="Rbtn" onClick="">Read More<i class="bi bi-arrow-right"></i></button></div>
2. Resulting in the below output:
<div class="Small-ButtonRSecond"><button class="Rbtn">Read More<i class="bi bi-arrow-right"></i></button></div>
Steps to reproduce:
1. Start the clean instance of Liferay DXP 2024.Q1.5.
2. Navigate to Web Content and create Basic web content.
3. Paste the below content in the source option and see that the onClick event is being removed.
<div class="Small-ButtonRSecond"><button class="Rbtn" onClick="">Read More<i class="bi bi-arrow-right"></i></button></div>
Actual Results: onclick event is being removed from the source.
Expected Results: onclick event should be visible in the source.
Environment
- 2024.Q1.5
Resolution
- The onclick event that is removed in DXP 2024.Q1.5 is an intended behavior in order to prevent any security risks.
- However, the above point is not only limited to onclick event to a button but is also applicable to other events as well. That means users cannot add any event to any element from the source tab.
- Some of the attributes are removed like onclick, onerror, onload, and others due to security vulnerabilities like XSS, by following the ckeditor best practices documentation.
- The above documentation of ckeditor strongly recommends disabling source mode to prevent XSS attacks, but since there is a need for source mode, it is recommended to filter the content to prevent these attacks.
- There is no alternative solution for the reported concern that allows onclick and similar events which may turn out to be a possible security threat to the entire application, and doing so could pose significant security risks to the portal.