HCL Connections switch to allowlists

A long time ago, I wrote about the new implementation of allowlists in HCL Connections and that the documentation on customization and adding new rules was an absolute miracle for me.

I haven’t implemented allowlists at any customer at the moment, because the first tries in 2018 were horrible. Even formats from the builtin editors got deleted during the save procedure. During test deployments I often start with enabled allowlists, but later I always switch back to blocklists.

For a support ticket I had to check some settings today, and so I tried with enabled allowlist and blocklist. This let me remember the old blog post and I wanted to check if custom rules can be added now.

Allow <style>

#

Some environments allow formatting with style tags in the HTML source of documents. So this is the starting point, how can we allow <style>.

Let’s follow the official documentation Configuring active content filters first.

Locate the ojhs-whitelist-default.xml

#

Copy files

#

I decided to name my allowlist stoeps.

cd /opt/IBM/WebSpere/AppServer/profiles/Dmgr01/config/cells/cellname/LotusConnections-config/extern
cp ojhs-whitelist-default.xml ojhs-whitelist-stoeps
cp acp-configkey__default.xml acp-configkey__stoeps.xml

Now edit the copied files and change following lines:

acp-configkey__stoeps.xml

#

sed -i 's/defaultKey=default/defaultKey=stoeps/g' acp-configkey__stoeps.xml

ojhs-whitelist-stoeps.xml

#

Here I replaced the watsonworkspace protocol with the file-protocol, and added the <style> tag.

In case of style this is not enough, because we need to allow text between the tags:

	<!-- Allow text within style tag -->
	<allowTextIn>
		<element name="style"/>
	</allowTextIn>

Here the diff of the original file and my customized one

#

 -- ojhs-whitelist-default.xml	2021-11-10 14:28:04.191941833 +0100
+++ ojhs-whitelist-stoeps.xml	2021-11-17 12:11:42.336626537 +0100
@@ -1,4 +1,4 @@
-<whitelist id="Default"
+<whitelist id="stoeps"
 	xmlns="http://www.ibm.com/connections/acf/ojhs/whitelist/1.0"
 	xmlns:tns="http://www.ibm.com/connections/acf/ojhs/whitelist/1.0"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
@@ -115,12 +115,13 @@
 		<element name="dir"/>
 		<element name="noembed"/>
 		<element name="xmp"/>
+		<element name="style"/>
 	</allowElements>
 	<allowUrlProtocols>
 		<protocol name="ftp" />
 		<protocol name="tel" />
 		<protocol name="notes" />
-		<protocol name="watsonworkspace" />
+		<protocol name="file" />
 	</allowUrlProtocols>

@@ -905,5 +908,10 @@
 		<elementAttribute name="dir" val="ltr"/>
 	</transformElements> -->

+	<!-- Allow text within style tag -->
+	<allowTextIn>
+		<element name="style"/>
+	</allowTextIn>

To activate the allowlist we need to edit LotusConnections-config.xml and replace all occurrences of acp-configkey__default.xml with acp-configkey__stoeps.xml.

I couldn’t find a way to allow only specific elements within the style-tag. So allowing style with allowTextIn allows all CSS.

Best way to edit LotusConnections-config.xml is checking out and in, so you get syntax validation. In the article Using the Profiles database as the user directory are these steps explained.

Finally synchronize the nodes and restart all Connections Clusters.

Testing

#

I did some tests before I added the new rules. So I could add following code to a richtext widget on the overview page (or highlights).

<style type="text/css">
.someclass {
    color: white !important;
    background-color: blue;
    font-weight: bold;
    }
.wheader, widgetTitle {
    background-color: lightblue;
    font-weight: bold;
    }
</style>
<p dir="ltr" style="color:blue;background-color:yellow;font-weight:bold;float:right;font-size:2em;padding:5px;margin:2px;margin-top:20px;margin-bottom:20px">Test with style attribute within the p tag.</p>

<p class="someclass" dir="ltr">Test with a class name.</p>

<p dir="ltr">Additionally added css style to change background-color of widget title.</p>

With default allowlist, the following code is stored:

<p style="background-color:blue;color:green">Testing some code</p>
<p class="aaa">Testing some code</p>

To enable the style= attribute, have a look at Styling rules. The documentation tells us, that we have to enable this, but during my test with the default allowlist, styles were allowed. I doublechecked and in the default list it is already enabled. Style attributes are only styling the tag they are set in, so you can’t screw up the whole page.

Activate the customized allowlist and try again

#

After activation, the code is saved without changes, and so we can see the possible issue of allowing styles in user documents.

You see the users are able to change the color of the whole page (in this case the header background in Highlights). Not a big issue when they only change colors, but I already had users changing and hiding major parts of the connections overview page, so it can happen that they break widgets!

Fun with CSS - Hide a widget

#

Now I add display:none to hide the description widget. I use the aria-label to select the description widget here.

div[aria-label="description"] {display:none;}

A cool way to customize a community, but this opens the door for a lot of missuse from user side, but it is definitly easier to achieve than adding themes to communities.

To-do and summary

#

Activating allowlists in environments which were deployed before 6.0 can be a challenge, because you don’t know which protocols, or tags are used.

Why is this a problem?

So if users open documents that have been saved with active blocklists, the allowlist may be more restrictive and delete some of the content. This can only be styles, so that the document simply looks different, but links can also be deleted because the protocols are not explicitly allowed.

The reason for this is the different philosophy of blocklists and allowlists, so in blocklists everything is allowed what is not listed. Allowlists reverse this approach, they only permit content maintained in the list. So if you forget an element, it will be removed during save.

On the other hand the allowlist is a decent way to increase the security, because it prevents user from storing possible malicious code.

So my to-do is digging into the databases and build a script to find all used tags and protocols. As a bonus question I’m highly interested to allow the style tag, but allow only some special css rules within this tag.