Rich Text Editor Component

IMPORTANT: Select component plug-ins are experiencing issues due to a recent browser update. If you encounter any problems with previously functional component plug-ins, please create a support case. If you notice other component plug-ins that are not functioning correctly, please create additional support cases for each instance.

Overview

Starting in 24.2, the Styled Text Editor Component is available directly in the product. Consider using this in place of the plug-in moving forward. For more information, review: https://docs.appian.com/suite/help/latest/Styled_Text_Editor_Component.html

Displays a field that allows for users to type text and format it with a variety of style options.
Output is saved as HTML. To get the raw character output, designers can use the Appian function fn!stripHtml() on the output.
HTML output can be passed into Send E-Mail node or document generation smart services. Note that not all formats supported by the Rich Text Editor component may be supported by e-mail or document generation.
Allows uploading of images which get stored in the specified Appian folder (requires separate install of the Rich Text Editor Connected System Plugin from https://community.appian.com/b/appmarket/posts/rich-text-editor-image-upload-connected-system).

Visit https://community.appian.com/w/the-appian-playbook/1378/end-user-rich-text-editor-component for more information. If you have any problems installing or using the component, please see the https://community.appian.com/w/the-appian-playbook/1603/rich-text-editor-component-plug-in-troubleshooting-guide

Key Features & Functionality

Component: fn!richTextField()
Allows for size validation
Allows for adjustable height
Allows for read-only / editable view
Supported font formats: "header", "size", "bold", "italic", "underline", "strike", "color", "background", "link", "align", "indent", "list"
Designer control over the allowed formats

Supported Browsers: Chrome, Firefox, Edge, Safari
Supported on Mobile

Jose Carlos Jarquin over 2 years ago

Hello,

Recently, we have noticed that hyperlinks created within the rich text editor component have been getting an additional string attached in the HTML code. The additional string added is 'rel="noopener noreferrer"'. Is this behavior expected? The additional string is causing some issues in interfaces where we extract the HTML links from the component value and display them separately.

Any information is appreciated!
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
chandhinir0002 over 2 years ago in reply to Jed Fonner

Thanks for the update!
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Jed Fonner over 2 years ago in reply to chandhinir0002

I searched and I think this is the CVE you're referring to: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3163

If it's not, please let me know.

That CVE talks about storing an XSS payload via an onloadstart attribute of an IMG element. That is not exploitable by the Rich Text Editor plugin. The plugin enforces an allow-list of possible HTML elements that can be used. Anything that doesn't match the allow-list will be sanitized and removed.

Also, if you follow the links to the related Issue on the Quill repository, https://github.com/quilljs/quill/issues/3364, you'll see that this is only an issue "if untrusted content is loaded". That's not the case with the Rich Text Editor. Snyk has updated to say "this was deemed not a vulnerability": security.snyk.io/.../SNYK-JS-QUILL-1245047

Long story short, this issue with the underlying Quill library isn't exploitable in the Rich Text Editor.
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
chandhinir0002 over 2 years ago

Hi,

We are facing the vulnerability issues while scanning this plugin. Please find the issues below and kindly help to check.

Quill Rich Text Editor:
Quill is vulnerable to stored cross-site scripting (XSS) because it does not correctly sanitize user input before it is processed. An attacker could exploit this flaw to execute malicious JavaScript code in a victim's browser, which can result in the theft of session tokens or cookies. **Note**: the vendor disputes this issue, asserting that potentially dangerous content should be sanitized before being passed and loaded into the Quill editor.

Thanks in advance!
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Sergio Valle over 2 years ago in reply to Jed Fonner

It works with the signed version!

2022-05-18 08:02:43,519 [Appian Plugin Hot Deploy] INFO com.appiancorp.plugins.osgi.LoggingPluginFactoryDecorator - Plug-in Artifact 'rich-text-editor-1.8.2_signed.zip' SHA256 hash is 2bdf4ad04447ef77fb99342afc7a615ee5a1b29d93c478b320f39b67338863f0
2022-05-18 08:02:43,779 [Appian Plugin Hot Deploy] INFO com.appiancorp.plugins.component.ComponentPluginFactory - Component plug-in package rich-text-editor-1.8.2_signed.zip loaded in 259ms
2022-05-18 08:02:43,852 [Appian Plugin Hot Deploy] INFO com.appiancorp.plugins.LoggingPluginEventListener - Successfully installed Component Plug-in 'Rich Text' (com.appian.richtext)
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Sergio Valle over 2 years ago in reply to Jed Fonner

Thank you Jed!
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Jed Fonner over 2 years ago in reply to Sergio Valle

The AppMarket team has uploaded the Download link to provide the correct, signed version of the plugin. Please download the latest version and try again. The filename should be rich-text-editor-1.8.2_signed.zip
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Appian AppMarket over 2 years ago in reply to Sergio Valle

Hi Sergio Valle - apologies for the confusion. There was an issue with the download file. We have updated the file and rich-text-editor-1.8.2_signed.zip is available for download.
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Sergio Valle over 2 years ago in reply to Jed Fonner

Thank you Jed!
- Cancel
- Up 0 Down
- Reply
- More
- Cancel
Jed Fonner over 2 years ago in reply to Sergio Valle

I'll escalate this to the App Market approvers group and see if they can help.
- Cancel
- Up 0 Down
- Reply
- More
- Cancel