Wiki: Include html content on Raw HTML Editor dont reproduce html

[luanknebel]

When displaying a page written by HTML, the HTML code is displayed instead of reproducing the HTML content

To Reproduce
Steps to reproduce the behavior:
1 - Create a new page with Raw HTML type
2 - Include tag iframe from You Tube, example:

3- The displayed content is the html code and not the video.
Expected behavior
Show video from iframe

Screenshots

Host Info (please complete the following information):

• OS: CentOS 7
• Wiki.js version: 2.2.51
• Database engine: postgres 10.12

Additional context
The content written in the HTML editor is displayed in double quotes and the browser cannot interpret the written html.

[Smankusors]

You need to disable HTML Sanitizer on Security rendering module. After that you can re-render the page and see if the iframe shows up

[joppehoekstra]

This doesn't seem like a proper way to solve this problem. The expected behaviour of the HTML sanitizer is to only remove content from 'untrustable' sources. Even when embedding videos using the visual editor, the video is not rendered on the page (it is rendered in the editor, as described in this issue.

[Smankusors]

This doesn't seem like a proper way to solve this problem. The expected behaviour of the HTML sanitizer is to only remove content from 'untrustable' sources. Even when embedding videos using the visual editor, the video is not rendered on the page (it is rendered in the editor, as described in this issue.

well yes, but this is iframe. Anything malicious can happen. Are you really "trust your editors" about it?

[joppehoekstra]

well yes, but this is iframe. Anything malicious can happen. Are you really "trust your editors" about it?

You're right, what I meant to say was: it would be better to wait for the implementation of rendering videos added in the visual editor automatically, instead of turning off the HTML Sanitizer (because as you rightly point out, this would cause security issues).

[luanknebel]

Thanks for this support, I initially disabled HTML Sanitize for now. We can close this issue?

[Smankusors]

Thanks for this support, I initially disabled HTML Sanitize for now. We can close this issue?

if your issue is resolved, feel free to close yourself 🙂