Meta tags:
description= My contribution to the Notes & Domino community;
Headings (most frequently used words):
domino, filter, work, in, progress, logs, on, notes, the, is, it, for, application, check, kwintessential, introduction, my, contribution, to, community, great, ideas, but, where, follow, up, why, so, quiet, about, this, sanitize, xpages, input, fields, creating, an, sbom, and, performing, security, owasp, vulnerability, replacing, ckeditor, with, quill, make, tika, v12, save, again, support, software, projects, recent, posts, cv, docs, education, categories, tags, openntf, rss, feed, downloads, log, run4fun, bildr, appdev, template, team, documents, born, social,
Text of the page (most frequently used words):
the (292), and (106), you (99), for (67), with (58), this (49), that (40), #domino (32), are (32), #application (32), your (32), can (29), not (29), have (28), but (27), xpages (25), will (25), jar (24), some (23), from (23), file (23), notes (21), development (21), hcl (20), was (20), openntf (19), what (19), want (18), java (17), work (17), code (17), files (17), vulnerability (17), would (17), more (16), maven (16), syft (16), tika (15), html (15), source (15), filter (15), run (15), text (15), grype (15), logs (14), download (14), check (14), 2026 (14), scan (14), odp (14), mail (14), applications (13), here (13), github (13), version (13), owasp (13), template (12), nsf (12), how (12), project (12), there (12), phaselistener (12), fields (12), security (11), about (11), time (11), patrick (11), kwinten (11), perhaps (11), sanitize (11), form (11), when (11), which (11), sbom (11), comment (10), report (10), other (10), control (10), first (10), where (10), link (10), them (10), build (10), folder (10), all (10), use (10), then (10), data (10), log (9), projects (9), agent (9), software (9), need (9), used (9), server (9), like (9), leave (9), only (9), now (8), search (8), page (8), happy (8), process (8), windows (8), open (8), via (8), get (8), one (8), input (8), bootstrap (7), json (7), error (7), set (7), make (7), find (7), take (7), https (7), see (7), apache (7), any (7), nvd (7), could (7), special (7), com (6), follow (6), xml (6), git (6), library (6), great (6), progress (6), running (6), does (6), support (6), new (6), terminal (6), variables (6), environment (6), example (6), vulnerabilities (6), probably (6), may (6), editor (6), added (6), mode (6), scanning (6), also (6), database (6), before (6), issue (6), exe (6), scenario (6), required (5), blog (5), ibm (5), api (5), design (5), create (5), add (5), product (5), v12 (5), app (5), path (5), clean (5), skip (5), true (5), repository (5), 2025 (5), system (5), jdk (5), openjdk (5), following (5), command (5), click (5), secure (5), because (5), still (5), provides (5), available (5), upgrade (5), latest (5), again (5), being (5), stored (5), resources (5), platform (5), has (5), dependency (5), bat (5), nvdapikey (5), your_application_key_here (5), don (5), local (5), case (5), update (5), machine (5), into (5), look (5), jsoup (5), their (5), view (4), kwintessential (4), jsf (4), javascript (4), extension (4), access (4), service (4), custom (4), social (4), using (4), why (4), ideas (4), documents (4), provided (4), define (4), alternative (4), developers (4), since (4), give (4), community (4), release (4), after (4), install (4), generate (4), cve (4), allow (4), learn (4), installed (4), type (4), changes (4), steps (4), quill (4), ckeditor (4), web (4), without (4), standards (4), become (4), updated (4), june (4), good (4), nice (4), gave (4), noupdate (4), evaluation (4), out (4), never (4), libraries (4), thought (4), once (4), index (4), less (4), than (4), had (4), sure (4), top (4), ran (4), should (4), idea (4), yaml (4), working (4), javax (4), september (4), progressive (4), content (3), side (3), bildr (3), mobile (3), lotusscript (3), lotus (3), jquery (3), connections (3), education (3), dojo (3), dde (3), fun (3), select (3), designer (3), single (3), overview (3), document (3), quickly (3), against (3), target (3), default (3), filters (3), contribution (3), these (3), post (3), made (3), activities (3), network (3), dskiptests (3), tests (3), mvn (3), clone (3), url (3), microsoft (3), releases (3), installation (3), program (3), under (3), key (3), able (3), extract (3), downloaded (3), zip (3), higher (3), based (3), upon (3), client (3), fork (3), none (3), guidelines (3), options (3), last (3), rich (3), know (3), otherwise (3), yeah (3), result (3), something (3), much (3), least (3), start (3), friendly (3), let (3), forms (3), current (3), who (3), regarding (3), they (3), step (3), especially (3), dependencies (3), disableossindex (3), inside (3), ext (3), additional (3), lib (3), request (3), corporate (3), around (3), basically (3), stick (3), tried (3), just (3), started (3), someone (3), try (3), reports (3), feature (3), branch (3), google (3), env (3), read (3), faces (3), tagging (3), comes (3), clear (3), xsp (3), pages (3), focus (3), standard (3), makes (3), right (3), best (3), area (3), modern (3), ndext (3), jakarta (3), been (3), miscellaneous (3), events (3), email (2), write (2), comments (2), sign (2), site (2), subscribe (2), menu (2), rss (2), manager (2), appdev (2), video (2), stockholm (2), rest (2), openlog (2), linkedin (2), help (2), eclipse (2), css (2), books (2), bluemix (2), formula (2), test (2), news (2), discussion (2), categories (2), administration (2), manual (2), distribution (2), wizard (2), spaw (2), born (2), quiet (2), posts (2), team (2), upload (2), share (2), images (2), run4fun (2), possible (2), entries (2), servers (2), therefor (2), opensource (2), ware (2), investigate (2), include (2), trying (2), company (2), previous (2), uncategorized (2), successful (2), hardware (2), speed (2), skips (2), dcheckstyle (2), checks (2), directory (2), desktop (2), 66516 (2), 54988 (2), executable (2), official (2), older (2), choose (2), prompt (2), powershell (2), save (2), bin (2), named (2), edit (2), anywhere (2), place (2), section (2), org (2), cgi (2), sas (2), complete (2), fixes (2), documentation (2), blob (2), while (2), greatest (2), tinymce (2), happen (2), sanitizer (2), webquerysave (2), submit (2), event (2), doing (2), demo (2), bit (2), integrate (2), promising (2), change (2), property (2), think (2), traditional (2), haven (2), embedded (2), its (2), license (2), hope (2), writing (2), provide (2), cdn (2), uses (2), contain (2), better (2), details (2), findings (2), store (2), listed (2), jvm (2), lead (2), got (2), noticed (2), firewall (2), oss (2), driven (2), option (2), parameter (2), beware (2), soon (2), ovc (2), different (2), transfer (2), usb (2), within (2), somewhere (2), shameless (2), plug (2), took (2), developer (2), faced (2), coding (2), course (2), few (2), advice (2), suggest (2), session (2), thomas (2), hampel (2), vulnerable (2), problem (2), pom (2), helpful (2), tmpl (2), asked (2), false (2), fetch (2), outside (2), similar (2), table (2), created (2), human (2), both (2), come (2), creating (2), bill (2), materials (2), packages (2), tells (2), wrong (2), solutions (2), starter (2), ask (2), simple (2), advanced (2), mvc (2), architecture (2), received (2), wide (2), config (2), class (2), preserve (2), basic (2), textarea (2), our (2), interested (2), field (2), usual (2), suspect (2), operate (2), level (2), certain (2), radiobuttons (2), scenarios (2), xpage (2), register (2), across (2), global (2), logging (2), messages (2), practice (2), environments (2), even (2), approach (2), tools (2), malicious (2), wants (2), besides (2), ciao (2), having (2), unclear (2), match (2), another (2), understand (2), date (2), elements (2), august (2), effect (2), v14 (2), please (2), send (2), really (2), runtime (2), sometimes (2), notification (2), imports (2), summary (2), tracking (2), october (2), website, name, loading, collapse, bar, manage, subscriptions, reader, privacy, wordpress, account, join, subscribers, subscribed, language, bean, downloads, feed, below, examples, notifier, cardscanr, wiki, webinar, usability, twitter, teamroom, ssjs, rwd, roadmap, pdf, partial, refresh, oneui, notesview, navigation, controls, lotusphere, ideajam, html5, extlib, dijit, datatables, breadcrumbs, tags, xsl, 121, tyt, sntt, show, tell, thursday, sbt, sdk, sandbox, prototype, graph, gdpr, frameset, font, awesome, cloudant, career, cardscan, calendaring, blogroll, 106, ajax, activepdf, category, sourcetree, 901v00_06, 20140424, 0600, scratch, hands, graphnsf, docs, recent, popular, sat, mash, management, intended, teams, enhancements, compete, runners, score, points, lapses, near, lapse, remove, highlight, databases, multiple, monitoring, efficient, marketplace, offer, paid, neither, independent, money, too, hard, soft, beer, peanuts, leasure, continue, maintain, spent, answering, faq, suggestions, viable, profile, specialist, 1996, personal, opinions, introduction, articles, ready, fat, module, locate, displayed, depending, wait, finish, removes, old, builds, rebuilds, consuming, optional, faster, style, navigate, cloned, included, wrapper, flag, significantly, speeds, alt, copy, java_home, microsofts, versions, convenience, information, window, cmd, paste, full, variable, button, bottom, press, setting, move, extracted, permanent, location, binary, archive, produce, retrieve, compile, comprehensive, analysis, extensive, coverage, detailed, two, critical, external, entity, xxe, modified, sassoftware, readme, yourself, remaining, aware, core, luckily, issues, cope, wont, decent, function, informed, instant, third, party, innerhtml, quills, followed, doesn, whatever, incoming, looks, purposes, webqueryopen, referred, thereafter, seems, impressions, looking, hurdle, package, separate, require, static, words, recreate, gray, lately, reached, end, life, 2023, avoid, alternatives, priced, replacing, food, thoughts, safety, organisation, though, considerations, left, consume, services, plugins, debug, toolbar, downloading, ins, outs, pre, concern, description, recommendation, containing, sake, copied, tmp, jars, worry, back, turns, ovd, difficulties, broke, bridge, x86, removed, directly, pick, distribute, awkward, effects, scanned, theme, confronted, behind, message, accessed, secondary, resource, complement, locally, calls, disable, accessing, becomes, frequently, bare, mind, discovered, blocking, national, installing, initiated, repo, disk, registered, compatibel, line, decided, listen, warning, considerable, told, confirmation, follows, descriptions, whether, getting, seasoned, curious, foundation, supported, ordering, risks, asvs, providing, inform, appsec, flagship, offered, watching, pluralsight, mentioned, recommended, wondered, interest, big, picture, investigated, machines, trigger, automate, collecting, ideally, early, merge, develop, braindump, automating, years, ago, wise, introduce, sort, artifactory, distributed, greater, wider, prioritize, most, fully, customaizable, logo, billing, customer, linked, scope, met, already, adds, such, consideration, twistie, distription, related, urls, brings, advisory, severity, state, fixed, pretty, amazing, security_report, generating, transferred, grype_db_auto_update, grype_db_validate_age, grype_db_cache_dir, complained, fire, wall, restrictions, did, procedure, amd, fall, behaviour, fetching, settings, note, valid, half, mission, accomplished, fancy, syft_report, sbom_report, horrific, sbom_readable, txt, console, readable, cyclonedx, far, opened, sboms, containers, directories, shouldnt, difficulty, describe, results, described, structured, inventory, listing, piece, those, components, stage, creation, cicd, pipeline, anchore, wrote, rather, expect, own, powered, offering, performing, regardless, plain, sophisticated, notice, implemented, measurement, adapting, setsubmittedvalue, final, receive, trips, cases, connected, lines, play, suitable, each, formatting, relaxed, basicwithimages, simpletext, defaults, safelist, object, others, styleclass, identify, way, ordinary, forrm, testbean, excluded, lateri, list, tied, distinguish, between, marked, classname, checkboxes, forget, hidden, users, normally, enter, accessible, permissions, ignorant, depends, vanilla, done, exactly, amount, adaption, built, javaserver, powerful, hook, lets, execute, phases, processing, lifecycle, commonly, tasks, routing, multi, dynamically, altering, themes, localization, fly, next, image, phasetlistener, runs, decision, implement, simplicity, imported, production, purposed, suggestion, recommend, several, cons, pros, suits, situation, implementing, solution, cover, understood, correctly, power, responsibility, active, filtering, etc, exploitation, tedious, task, protect, entry, validate, numerous, approaches, keeping, eye, trends, penetration, testing, daily, watch, tend, stuck, burp, suite, chances, someday, somehow, act, infrastructure, protection, main, large, number, organizations, specialized, july, vote, ofcourse, hand, dialogue, might, appscan, bet, engineers, surprised, coming, strategy, fact, believe, lack, capabilities, considered, risk, argue, black, among, corporations, scene, unfinished, broken, promise, destruction, portfolio, tractor, branching, features, commits, straight, master, review, integration, jira, computers, opportunities, readible, stamps, messing, creates, unreadible, classic, yes, everybody, likes, must, willing, due, uncertainty, modernized, gonna, question, upcoming, connect, voting, choice, newer, classes, shipped, questions, headed, over, won, upgrading, face, appear, portal, guess, intention, modernize, functionaly, smtp, according, currently, golden, generated, easy, adapt, implementation, however, nocastexception, tackling, checking, debugging, remained, switched, provider, immediately, warned, limitations, suggested, sensible, compared, requirements, nevertheless, came, same, entered, explained, mean, precedence, luck, suck, stumble, many, goodies, perform, above, views, validation, backslash, quotes, hopefully, solved, applying, regular, expression, during, improvements, selected, specify, enable, sending, notifications, weekends, updates, flexible, smaller, sets, imprt, biggest, instead, importing, per, day, scans, continuously, interval, handy, monitor, applied, turned, notify, previously, owner, responsible, sense, needed, down, collections, happening, initial, attempt, header, contains, finding, occurrences, rounding, pieces, charting, trend, occurrence, specific, dashboard, chart, adding, charts, videos, teachers, badges, weblog, home, primary,
Text of the page (random words):
imple plain xpages application or an advanced one with a sophisticated mvc architecture you will notice that the phaselistener will sanitize the data received and you have implemented a security measurement application wide with only adapting the faces config xml file and writing an additional java class file happy secure development security jsf jsoup owasp sanitize xpages creating an sbom for a domino application and performing a security check on it 2026 june 8 2026 june 5 patrick kwinten leave a comment in a previous post i wrote about how to use the owasp vulnerability check to scan your domino application rather it s odp than the nsf for vulnerabilities and generate a report for it as you would expect there are more solutions for it and hcl has it s own ai powered offering for this but when you are in an evaluation stage or you want to more quickly try to integrate the creation of the sbom and vulnerability scanning into your cicd pipeline then take a look at syft and grype both opensource projects provided by anchore syft is here to generate an software bill of materials for you which can be described as a structured inventory listing all libraries packages and dependencies used in a piece of software grype will scan that software bill of materials for vulnerabilities so syft tells you what s in your software packages dependencies grype tells you what s wrong with those components vulnerabilities syft can create sboms from containers images and file directories so an odp shouldnt be any difficulty i will describe the steps i took to get some results the first step is to download both projects from github i downloaded the latest windows releases i started with the installation of syft to see how far i would come with creating an sbom as source i used once again my fun project available on openntf shameless plug and created a local odp from it i opened it in the terminal and started with c ws syft syft exe o cyclonedx json sbom json yeah it created me a sbom but is was not human friendly to read so i tried c ws syft syft exe o table which gave me a nice r table in the console to have it in a readable text file i tried then c ws syft syft exe o text sbom_readable txt which gave me the text file but still it was horrific to read i asked google for a template to generate a report in html and ran c ws syft syft exe o template t syft_report tmpl sbom_report html this gave me the following more promising and fancy file so half of the mission accomplished i then installed grype and try to run it via c ws grype grype exe sbom sbom json but it complained that it could not find a vulnerability database and that it ran into an error while trying to fetch one again the fire wall restrictions did not allow me to go outside the network so a similar procedure as with the owasp vulnerability check i had to follow install grype on a machine outside the network fetch the database amd transfer it via an usb stick to my corporate machine but to make sure that grype would not fall in its default behaviour of fetching the latest vulnerability database i had to set some environment settings note terminal session valid env grype_db_auto_update false env grype_db_validate_age false env grype_db_cache_dir c ws grype grype db where grype db is the folder where i transferred the vulnerability database to i once again asked google to provide me a template for generating the vulnerability report with and added that to project then i ran c ws grype grype exe sbom sbom json o template t template tmpl security_report html and the result report is pretty amazing if you click on the twistie before the file you get a distription of the issue with related urls and the vulnerability link brings you to the github advisory db with more details especially the severity state and fixed in are helpful and someone has to update that application with file on openntf so some consideration after this evaluation if you do not have the files in your nsf and therefor not in your odp you have a problem i am not sure if syft can also work with a pom xml file but you could build something that adds such a pom file to your odp resources from the server e g via the extension library linked resources in other nsf s or cdn s are also out of scope but we met that issue with the owasp check already the report can use a template so it is fully customaizable just add your company logo and start billing your customer it would be wise to introduce some sort of artifactory for your domino environment in which you store the jar files distributed on your servers and use that one as source for your sbom and vulnerability report with a greater wider overview you can better prioritize the most vulnerable files first perhaps beware this is an evaluation ran on a local machine i have not investigated that you can run it on other machines but it is powershell so you should be able to trigger it from lotusscript and perhaps build an agent to automate start collecting and scanning for you and mail the reports to you ideally you would like to include the vulnerability scanning as early as possible i would suggest before the developer merge any feature branch into the develop branch in git i was at a hcl braindump session once in stockholm where thomas hampel thought automating the build process was a great idea for domino development but this was years ago my advice is to give syft and grype a try and learn from the reports happy development uncategorized grype sbom syft vulnerability owasp vulnerability check on a domino application 2026 june 4 patrick kwinten 1 comment i was watching the video owasp top 10 the big picture on pluralsight in which the owasp vulnerability check ovc was mentioned and recommended so i wondered if this would be of interest for my applications whether you are just getting started a seasoned developer or someone who is curious about secure development the owasp foundation is here to help with open community supported projects like the owasp top 10 ordering the top security risks faced by application developers to the asvs providing guidelines for secure coding and application development you are sure to find something to inform your appsec process this course is an overview of the owasp top 10 and a few other flagship projects offered by owasp so here follows a descriptions of the steps i took to scan an nsf for vulnerabilities and my findings the first step was to download the zip file from github and extract it somewhere local on my machine make sure the lib folder is registered in your system environment and you have a compatibel java version installed 11 or higher i first tried a scan via the command line against an odp of an fun application available on openntf shameless plug i decided to listen to the warning and run with an api key otherwise the process would take considerable more time i was told the api key request form you can find here and the confirmation form here dependency check bat scan odp nvdapikey your_application_key_here i am running the command in the local git repo where the nsf design data is stored as an on disk project within the folder named odp i soon discovered that the corporate firewall was blocking access to update the national vulnerability database nvd so i had to find a work around basically installing ovc on a different windows machine update the nvd database there and transfer it via a usb stick with an updated nvd in place i initiated a new scan but with the parameter to skip to update the nvd dependency check bat scan odp nvdapikey your_application_key_here noupdate i once again was confronted being behind a firewall because i got an error message the the oss index could not be accessed this index is a secondary vulnerability resource as a complement to nvd this one you can not download locally because calls to it are being made request driven via a rest service the only option you have is to disable accessing the index via a parameter beware that your scanning becomes less secure and you will get a less complete report the oss index is more frequently being updated than the nvd so bare that in mind dependency check bat scan odp nvdapikey your_application_key_here noupdate disableossindex true so now i got a report a nice html file but i only noticed client javascript libraries being scanned i thought the application was using some jar files and it s an xpages application using the bootstrap theme in this case i removed the jar files from the design and stored them directly in the jvm lib ext folder so designer would pick them up this is also how we distribute jar files on the server never inside the nsf because this may lead some awkward side effects dependency check bat scan odp scan c ws program files x86 hcl notes jvm lib ext nvdapikey your_application_key_here noupdate disableossindex true so why not scan against the local ext folder additional then it turns out that ovd have difficulties with scanning the jar files that hcl provides for the client at least the check broke at the first file access bridge jar probably because this is hcl ip and not listed anywhere in the nvd so for sake of the evaluation i copied the required jar files to a tmp folder inside the odp if you happen to store the jar files inside the nsf under code jars then you don t have this worry so back to dependency check bat scan odp nvdapikey your_application_key_here noupdate disableossindex true which gave me a nice html file containing the report here are my findings as you can see there is a concern for the file you get a nice description details and recommendation s so this is a good step especially if you are downloading applications from openntf and you do not know what the ins outs of the code are and it has dependencies you better pre scan the nsf or it s odp there are though still some considerations left to investigate does the application use resources provided by the platform server like bootstrap jquery and dojo does the application consume resources perhaps provided by other applications or services cdn s files stored in other nsf s does the application uses server plugins and what do they contain like the debug toolbar or openntf domino api i hope this writing will provide you more food for thoughts regarding the safety of your applications platform and organisation happy development security jar owasp vulnerability replacing ckeditor with quill 2026 may 26 patrick kwinten leave a comment in some gray applications traditional domino applications who haven t become updated lately we have ckeditor 4 as rich text editor embedded ckeditor 4 reached its end of life in june 2023 so time for an upgrade if you can t run the open source license and need to avoid any priced license you need to search for alternatives alternative tinymce require your web forms to run in standards mode to run so you need to change the forms property to run on the web as html but then a form become static in other words you need to re think recreate your current domino forms alternative quill seems to be a bit more friendly to integrate without the standards mode first impressions are looking promising so let s share them first hurdle is perhaps how to download the distribution file without a package manager installed i used this link to download the files separate and stored them as files in the resources files section thereafter i added to a form the html and js to build up the page on the webqueryopen event of the form i referred to an agent which is not doing much but for demo purposes provides some default html for the quill editor and when you open the form you will see this so this looks at least like a start to see what is being stored i added in the webquerysave event of the form to run an agent the agent doesn t do much but you can do now whatever you want with the incoming perhaps sanitize it for example if you submit something as followed this would be the result so yeah we have the text innerhtml from quills rich text web editor in notes if you happen to know a decent html sanitizer library function in ls i would be happy to be informed about it otherwise i would instant use a java agent for the webquerysave and use a third party library to sanitize the text for me happy development javascript ckeditor editor quill rich text tinymce make tika on domino v12 save again 2026 may 17 patrick kwinten 4 comments if you are still on a hcl domino v12 server you are probably aware that you wont be able to run the latest and greatest tika version so what options do you have upgrade to the last v2 version that would be v2 9 4 but then you still cope with some vulnerabilities in tika core luckily there is a fork on github that fixes the issues but then if you search for a jar to download there is none available so you have to build it yourself here follow some guidelines that i used to build me the tika app jar so i can use it in my xpages applications while remaining on domino v12 this jar file is based upon a modified version of the sas software tika fork available at https github com sassoftware tika blob 2 9 4 cve 2025 66516 cve 2025 54988 readme md this repository provides complete security fixes with comprehensive vulnerability analysis extensive test coverage 11 security tests and detailed documentation for two critical xml external entity xxe vulnerabilities in apache tika 2 9 4 to build the secure tika app 2 9 4 jar of the sas software fork you need to retrieve the source code and compile it with maven because this is a 2 x version you can still build it with java 8 or higher required used software hardware apache maven 3 6 https maven apache org download cgi git client github desktop jdk 8 or higher windows 64 version based upon openjdk https learn microsoft com sv se java openjdk download windows pc with access to maven running windows 10 follow these steps to re produce download maven go to the official apache maven download page https maven apache org download cgi download the binary zip archive file under the files section version 3 9 1 used extract and place extract the downloaded zip file move the extracted folder to a permanent location for example c program files maven apache maven 3 9 x setting environment variables to be able to use maven anywhere in the terminal you need to add the path to your system press the windows key and type environment variables and select edit system variables click the environment variables button at the bottom under system variables find the variable named path select it and click edit click new and paste the full path to the maven bin folder e g c program files maven apache maven 3 9 x bin click ok in all windows to save the changes check the installation open a new command prompt window cmd or powershell type the following command mvn version if the installation is successful you will see information about the maven version and the installed java version download jdk go to microsofts official page https ...
|
