Incorrect display of html messages sent by the bot via XMPP on Jabber clients of version 12.9.5+

[S.Vladimir]

Since version 12.9.5, the display of tags is broken(removed from the message), for example,the tags a, button, etc.
For example:
1)<button class="btn btn-primary" robot-type="robot-button" type="button" robot-message="Option1">Option1</button>
Version 12.9.4-Option1 button
Version 12.9.5+ - Plain Text "Option1"
2)<a href="http://example.com" target="_blank">Example</a>
Version 12.9.4-Example link
Version 12.9.5+ - nothing

Bot jid has been provisioned as an <AdminConfiguredBot> in jabber-config.xml.
Please let me know what has changed with version 12.9.5 and how can I get around it? Thanks.

[npetrele]

Can you please use TFTP to get the jabber-config.xml from the server and then post it here? 

[S.Vladimir]

Hi,

[npetrele]

The XML is malformed.  To start with, go through it and make sure all the XML only uses features that are available, and that the XML is entered correctly.  For example:

<page refresh="false"
preload="false">

Should be closed.  Perhaps <page refresh="false" preload="false />?  I'm not familiar with this setting, so I'm not sure that would work. Normally XML would be more like:

<page>

   <refresh>false</refresh>

   <preload>false</preload>

</page>  <--- Edited, forgot to close this tag

That looks normal to me, but I'm not sure what it is expecting. I do know that the failure to close that causes problems with the rest of jabber-config.xml.  Look at the hierarchy:

<config version="1.0">
	<Directory>
		<DirectoryServerType>UDS</DirectoryServerType>
		<UdsPhotoUriWithToken>
http://phupexampl.com;/%%uid%%.jpg
</UdsPhotoUriWithToken>
		<SipUri>mail</SipUri>
		<UseSIPURIToResolveContacts>true</UseSIPURIToResolveContacts>
		<BDISipUri>mail</BDISipUri>
		<BDISipUriToResolveContacts>true</BDISipUriToResolveContacts>
		<DirectoryURI>mail</DirectoryURI>
	</Directory>
	<Client>
		<Persistent_Chat_Enabled>true</Persistent_Chat_Enabled>
		<Persistent_Chat_Mobile_Enabled>true</Persistent_Chat_Mobile_Enabled>
		<jabber-plugin-config>
			<browser-plugin>
				<page refresh="false"
				      preload="false">
</browser-plugin>
			</jabber-plugin-config>
		</Client>
		<Options>
			<Start_Client_On_Start_OS>true</Start_Client_On_Start_OS>
			<CalendarIntegrationType>0</CalendarIntegrationType>
			<AdminConfiguredBot>
helper1@example.com;helper2@example.com;helper3@example.com
</AdminConfiguredBot>
			<Location_Mode>DISABLED</Location_Mode>
		</Options>
		<Policies>
			<InitialPhoneSelection>deskphone</InitialPhoneSelection>
			<EnableSIPURIDialling>true</EnableSIPURIDialling>
			<EnableCallPickup>true</EnableCallPickup>
			<EnableGroupCallPickup>true</EnableGroupCallPickup>
			<EnableOtherGroupPickup>true</EnableOtherGroupPickup>
			<EnableHuntGroup>true</EnableHuntGroup>
			<TelemetryEnabled>false</TelemetryEnabled>
			<BlockAccessoriesManagerPlugins> SennheiserJabberPlugin.dll</BlockAccessoriesManagerPlugins>
			<enableLocalAddressBookSearch>false</enableLocalAddressBookSearch>
			<SharePortRangeStart>45130</SharePortRangeStart>
			<SharePortRangeSize>20000</SharePortRangeSize>
		</Policies>
	</config>

 I'm also assuming you sanitized the users (helper1@example.com, etc.).  Obviously helper1@example.com won't work.

[S.Vladimir]

Thanks for the answer!
Indeed, when the settings were anonymizing the tag was skipped, but it is present in the original file. And in the original file, the bots have existing names not like example@..., all right.
We have information that this appears to be a known defect, CSCvy46405 and since version 14, for security reasons, some html tags have been disabled by default.
And there is a certain parameter that can disable this restriction. Isn't it?
The problem is still relevant. Thanks.

[AlexS2]

@S.Vladimir 

Did you find solution?

After 12.9.4 our bot not working)

[npetrele]

The solution is two-fold.  You need to use a Jabber version with the defect fixed. These are two versions that have been fixed:

14.0.1.55914
12.9.6.55898

You also need to make sure your jabber-config.xml is written correctly and has all the required tags.

[AlexS2 · Accepted solution]

Thanks for the answer!

Did you mean adminconfiguredbot && whitelistedbot ? jabber-config does not changed and worked with 12.9.4

Both versions still have problem with html tags. 

[npetrele]

I'm confused.  Earlier, you said:

"After 12.9.4 our bot not working"

And now you say:

"worked with 12.9.4"

Either way, 12.9.4 has the defect. You need to upgrade to one of these:

14.0.1.55914
12.9.6.55898

[AlexS2]

Sorry)

After 12.9.4 html have a problem. 12.9.4 latest version where everything works

Yes, i now about xss bug. But 14.0.1.55914 and 12.9.6.55898 remove attributes from message.

For example, i send div class="myclass"

The class will be removed from message.

---