Whatever message this page gives is out now! Go check it out!
HTML input sanitization for ColdFusion AJAX widgets
Last update:
Sep 6, 2026
Learn when dynamic HTML passed into ColdFusion AJAX widget tags and attributes must be sanitized, and how to use
GetSafeHTML() and AntiSamy policy files to do itWhen is sanitization required
Hardcoded HTML: no sanitization is needed
If the HTML you're passing into one of these attributes is a literal string you typed in your .cfm file, ship it as-is. You already control it, same as writing
<cfoutput>Hi <b>there</b></cfoutput> yourself. Dynamic HTML: sanitize with GetSafeHTML() before it reaches the tag
If the HTML is built from anything outside your source code, a database column, a query result, a bound URL/CFC response, a form field, a session/cookie value, another user's input, an external API, you must sanitize it first. These widgets render it as real markup; a
<script> or onerror= payload in that data executes exactly like it would in <cfoutput>#rawValue#</cfoutput>HTML rendered by these widgets is interpreted as markup. Untrusted values can therefore introduce active content in the same way as untrusted HTML rendered through cfoutput.
Tags and attributes that render HTML
Here are some examples of sanitizing HTML input. Sanitize dynamic values before passing them to the following tags and attributes.
| Tag | Attribute / Field | Dynamic content | Sanitization |
|---|---|---|---|
<cfgrid> (via <cfgridcolumn>) | Grid cell data | Query column orbound data source | Required |
<cfgrid> | Group header | Same bound data as cell rendering | Required |
<cflayout> | Tab title | Usually static, but treat any dynamically-built title as untrusted | Required, if dynamic |
<cflayout> | Tab tabTip | Same | Required, if dynamic |
<cflayout> | Accordion title | Same | Required, if dynamic |
<cfwindow> | title | Docs explicitly allow HTML here | Required, if dynamic |
<cfmap> | markerWindowContent | Bound via markerBind — DATA, almost always dynamic in practice | Required |
<cftooltip> | Tooltip content | Response from sourceforTooltip (an AJAX call) — DATA | Required |
<cfrichtexteditor> | Editor content | Stored rich text (e.g., previously saved user content) — DATA | Required |
cfdiv / cfajaxproxy bind sinks | AJAX responseText rendered into the page | AJAX responseText rendered into the page | Required when the bound page contains untrusted data |
Sanitize GetSafeHTML() or IsSafeHTML()
Use GetSafeHTML and isSafeHTML for every dynamic value. The following example shows the distinction between the original value, the sanitized value, and a safety check.
<cfoutput>
<cfset dirty = '<a href="https://example.com">link</a><script>alert(1)</script>'>
<cfset clean = GetSafeHTML(dirty)>
<p>Dirty: #EncodeForHTML(dirty)#</p>
<p>Clean: #EncodeForHTML(clean)#</p>
<p>Rendered: #clean#</p>
<p>Is safe? #IsSafeHTML(dirty)#</p>
<p>Is safe? #IsSafeHTML(clean)#</p>
</cfoutput>IsSafeHTML(value)GetSafeHTML(value [, policyFile, throwOnError])Resolve AntiSamy policy file
GetSafeHTML() / IsSafeHTML() , when run against an AntiSamy policy XML file, gets resolved in this order:- Use explicit
policyFileargument. For example,GetSafeHTML(dirty, "path/to/mypolicy.xml") - Set the flag
this.security.antisamypolicy = "path/to/mypolicy.xml";in Application.cfc. - Set default server settings in cfusion/lib/antisamy-basic.xml. Copy cfusion/lib/antisamy-basic.xml as your starting template and edit its
<tag>/<attribute>rules for what your app actually needs. For example, antisamy-basic.xml has no<tag name="img">rule at all, so<img>is stripped by default. If a field genuinely needs images (e.g.,cfmap markerWindowContent, orcflayout tabTip, both confirmed used for<img>), add one, following the same pattern as the existing<tag name="a">rule.
Important: Restart the server after editing a policy file on disk for the change to take effect.
We're glad. Tell us how this page helped.
We're sorry. Can you tell us what didn't work for you?
Share additional feedback to help us improve.
0/255
|
