Meta tags:
description=My contribution to the Notes & Domino community;

Headings (most frequently used words):

domino, filter, work, in, progress, logs, on, notes, the, is, it, for, application, check, kwintessential, introduction, my, contribution, to, community, great, ideas, but, where, follow, up, why, so, quiet, about, this, sanitize, xpages, input, fields, creating, an, sbom, and, performing, security, owasp, vulnerability, replacing, ckeditor, with, quill, make, tika, v12, save, again, support, software, projects, recent, posts, cv, docs, education, categories, tags, openntf, rss, feed, downloads, log, run4fun, bildr, appdev, template, team, documents, born, social,

Text of the page (most frequently used words):
the (292), and (106), you (99), for (67), with (58), this (49), that (40), #domino (32), are (32), #application (32), your (32), can (29), not (29), have (28), but (27), xpages (25), will (25), jar (24), some (23), from (23), file (23), notes (21), development (21), hcl (20), was (20), openntf (19), what (19), want (18), java (17), work (17), code (17), files (17), vulnerability (17), would (17), more (16), maven (16), syft (16), tika (15), html (15), source (15), filter (15), run (15), text (15), grype (15), logs (14), download (14), check (14), 2026 (14), scan (14), odp (14), mail (14), applications (13), here (13), github (13), version (13), owasp (13), template (12), nsf (12), how (12), project (12), there (12), phaselistener (12), fields (12), security (11), about (11), time (11), patrick (11), kwinten (11), perhaps (11), sanitize (11), form (11), when (11), which (11), sbom (11), comment (10), report (10), other (10), control (10), first (10), where (10), link (10), them (10), build (10), folder (10), all (10), use (10), then (10), data (10), log (9), projects (9), agent (9), software (9), need (9), used (9), server (9), like (9), leave (9), only (9), now (8), search (8), page (8), happy (8), process (8), windows (8), open (8), via (8), get (8), one (8), input (8), bootstrap (7), json (7), error (7), set (7), make (7), find (7), take (7), https (7), see (7), apache (7), any (7), nvd (7), could (7), special (7), com (6), follow (6), xml (6), git (6), library (6), great (6), progress (6), running (6), does (6), support (6), new (6), terminal (6), variables (6), environment (6), example (6), vulnerabilities (6), probably (6), may (6), editor (6), added (6), mode (6), scanning (6), also (6), database (6), before (6), issue (6), exe (6), scenario (6), required (5), blog (5), ibm (5), api (5), design (5), create (5), add (5), product (5), v12 (5), app (5), path (5), clean (5), skip (5), true (5), repository (5), 2025 (5), system (5), jdk (5), openjdk (5), following (5), command (5), click (5), secure (5), because (5), still (5), provides (5), available (5), upgrade (5), latest (5), again (5), being (5), stored (5), resources (5), platform (5), has (5), dependency (5), bat (5), nvdapikey (5), your_application_key_here (5), don (5), local (5), case (5), update (5), machine (5), into (5), look (5), jsoup (5), their (5), view (4), kwintessential (4), jsf (4), javascript (4), extension (4), access (4), service (4), custom (4), social (4), using (4), why (4), ideas (4), documents (4), provided (4), define (4), alternative (4), developers (4), since (4), give (4), community (4), release (4), after (4), install (4), generate (4), cve (4), allow (4), learn (4), installed (4), type (4), changes (4), steps (4), quill (4), ckeditor (4), web (4), without (4), standards (4), become (4), updated (4), june (4), good (4), nice (4), gave (4), noupdate (4), evaluation (4), out (4), never (4), libraries (4), thought (4), once (4), index (4), less (4), than (4), had (4), sure (4), top (4), ran (4), should (4), idea (4), yaml (4), working (4), javax (4), september (4), progressive (4), content (3), side (3), bildr (3), mobile (3), lotusscript (3), lotus (3), jquery (3), connections (3), education (3), dojo (3), dde (3), fun (3), select (3), designer (3), single (3), overview (3), document (3), quickly (3), against (3), target (3), default (3), filters (3), contribution (3), these (3), post (3), made (3), activities (3), network (3), dskiptests (3), tests (3), mvn (3), clone (3), url (3), microsoft (3), releases (3), installation (3), program (3), under (3), key (3), able (3), extract (3), downloaded (3), zip (3), higher (3), based (3), upon (3), client (3), fork (3), none (3), guidelines (3), options (3), last (3), rich (3), know (3), otherwise (3), yeah (3), result (3), something (3), much (3), least (3), start (3), friendly (3), let (3), forms (3), current (3), who (3), regarding (3), they (3), step (3), especially (3), dependencies (3), disableossindex (3), inside (3), ext (3), additional (3), lib (3), request (3), corporate (3), around (3), basically (3), stick (3), tried (3), just (3), started (3), someone (3), try (3), reports (3), feature (3), branch (3), google (3), env (3), read (3), faces (3), tagging (3), comes (3), clear (3), xsp (3), pages (3), focus (3), standard (3), makes (3), right (3), best (3), area (3), modern (3), ndext (3), jakarta (3), been (3), miscellaneous (3), events (3), email (2), write (2), comments (2), sign (2), site (2), subscribe (2), menu (2), rss (2), manager (2), appdev (2), video (2), stockholm (2), rest (2), openlog (2), linkedin (2), help (2), eclipse (2), css (2), books (2), bluemix (2), formula (2), test (2), news (2), discussion (2), categories (2), administration (2), manual (2), distribution (2), wizard (2), spaw (2), born (2), quiet (2), posts (2), team (2), upload (2), share (2), images (2), run4fun (2), possible (2), entries (2), servers (2), therefor (2), opensource (2), ware (2), investigate (2), include (2), trying (2), company (2), previous (2), uncategorized (2), successful (2), hardware (2), speed (2), skips (2), dcheckstyle (2), checks (2), directory (2), desktop (2), 66516 (2), 54988 (2), executable (2), official (2), older (2), choose (2), prompt (2), powershell (2), save (2), bin (2), named (2), edit (2), anywhere (2), place (2), section (2), org (2), cgi (2), sas (2), complete (2), fixes (2), documentation (2), blob (2), while (2), greatest (2), tinymce (2), happen (2), sanitizer (2), webquerysave (2), submit (2), event (2), doing (2), demo (2), bit (2), integrate (2), promising (2), change (2), property (2), think (2), traditional (2), haven (2), embedded (2), its (2), license (2), hope (2), writing (2), provide (2), cdn (2), uses (2), contain (2), better (2), details (2), findings (2), store (2), listed (2), jvm (2), lead (2), got (2), noticed (2), firewall (2), oss (2), driven (2), option (2), parameter (2), beware (2), soon (2), ovc (2), different (2), transfer (2), usb (2), within (2), somewhere (2), shameless (2), plug (2), took (2), developer (2), faced (2), coding (2), course (2), few (2), advice (2), suggest (2), session (2), thomas (2), hampel (2), vulnerable (2), problem (2), pom (2), helpful (2), tmpl (2), asked (2), false (2), fetch (2), outside (2), similar (2), table (2), created (2), human (2), both (2), come (2), creating (2), bill (2), materials (2), packages (2), tells (2), wrong (2), solutions (2), starter (2), ask (2), simple (2), advanced (2), mvc (2), architecture (2), received (2), wide (2), config (2), class (2), preserve (2), basic (2), textarea (2), our (2), interested (2), field (2), usual (2), suspect (2), operate (2), level (2), certain (2), radiobuttons (2), scenarios (2), xpage (2), register (2), across (2), global (2), logging (2), messages (2), practice (2), environments (2), even (2), approach (2), tools (2), malicious (2), wants (2), besides (2), ciao (2), having (2), unclear (2), match (2), another (2), understand (2), date (2), elements (2), august (2), effect (2), v14 (2), please (2), send (2), really (2), runtime (2), sometimes (2), notification (2), imports (2), summary (2), tracking (2), october (2), website, name, loading, collapse, bar, manage, subscriptions, reader, privacy, wordpress, account, join, subscribers, subscribed, language, bean, downloads, feed, below, examples, notifier, cardscanr, wiki, webinar, usability, twitter, teamroom, ssjs, rwd, roadmap, pdf, partial, refresh, oneui, notesview, navigation, controls, lotusphere, ideajam, html5, extlib, dijit, datatables, breadcrumbs, tags, xsl, 121, tyt, sntt, show, tell, thursday, sbt, sdk, sandbox, prototype, graph, gdpr, frameset, font, awesome, cloudant, career, cardscan, calendaring, blogroll, 106, ajax, activepdf, category, sourcetree, 901v00_06, 20140424, 0600, scratch, hands, graphnsf, docs, recent, popular, sat, mash, management, intended, teams, enhancements, compete, runners, score, points, lapses, near, lapse, remove, highlight, databases, multiple, monitoring, efficient, marketplace, offer, paid, neither, independent, money, too, hard, soft, beer, peanuts, leasure, continue, maintain, spent, answering, faq, suggestions, viable, profile, specialist, 1996, personal, opinions, introduction, articles, ready, fat, module, locate, displayed, depending, wait, finish, removes, old, builds, rebuilds, consuming, optional, faster, style, navigate, cloned, included, wrapper, flag, significantly, speeds, alt, copy, java_home, microsofts, versions, convenience, information, window, cmd, paste, full, variable, button, bottom, press, setting, move, extracted, permanent, location, binary, archive, produce, retrieve, compile, comprehensive, analysis, extensive, coverage, detailed, two, critical, external, entity, xxe, modified, sassoftware, readme, yourself, remaining, aware, core, luckily, issues, cope, wont, decent, function, informed, instant, third, party, innerhtml, quills, followed, doesn, whatever, incoming, looks, purposes, webqueryopen, referred, thereafter, seems, impressions, looking, hurdle, package, separate, require, static, words, recreate, gray, lately, reached, end, life, 2023, avoid, alternatives, priced, replacing, food, thoughts, safety, organisation, though, considerations, left, consume, services, plugins, debug, toolbar, downloading, ins, outs, pre, concern, description, recommendation, containing, sake, copied, tmp, jars, worry, back, turns, ovd, difficulties, broke, bridge, x86, removed, directly, pick, distribute, awkward, effects, scanned, theme, confronted, behind, message, accessed, secondary, resource, complement, locally, calls, disable, accessing, becomes, frequently, bare, mind, discovered, blocking, national, installing, initiated, repo, disk, registered, compatibel, line, decided, listen, warning, considerable, told, confirmation, follows, descriptions, whether, getting, seasoned, curious, foundation, supported, ordering, risks, asvs, providing, inform, appsec, flagship, offered, watching, pluralsight, mentioned, recommended, wondered, interest, big, picture, investigated, machines, trigger, automate, collecting, ideally, early, merge, develop, braindump, automating, years, ago, wise, introduce, sort, artifactory, distributed, greater, wider, prioritize, most, fully, customaizable, logo, billing, customer, linked, scope, met, already, adds, such, consideration, twistie, distription, related, urls, brings, advisory, severity, state, fixed, pretty, amazing, security_report, generating, transferred, grype_db_auto_update, grype_db_validate_age, grype_db_cache_dir, complained, fire, wall, restrictions, did, procedure, amd, fall, behaviour, fetching, settings, note, valid, half, mission, accomplished, fancy, syft_report, sbom_report, horrific, sbom_readable, txt, console, readable, cyclonedx, far, opened, sboms, containers, directories, shouldnt, difficulty, describe, results, described, structured, inventory, listing, piece, those, components, stage, creation, cicd, pipeline, anchore, wrote, rather, expect, own, powered, offering, performing, regardless, plain, sophisticated, notice, implemented, measurement, adapting, setsubmittedvalue, final, receive, trips, cases, connected, lines, play, suitable, each, formatting, relaxed, basicwithimages, simpletext, defaults, safelist, object, others, styleclass, identify, way, ordinary, forrm, testbean, excluded, lateri, list, tied, distinguish, between, marked, classname, checkboxes, forget, hidden, users, normally, enter, accessible, permissions, ignorant, depends, vanilla, done, exactly, amount, adaption, built, javaserver, powerful, hook, lets, execute, phases, processing, lifecycle, commonly, tasks, routing, multi, dynamically, altering, themes, localization, fly, next, image, phasetlistener, runs, decision, implement, simplicity, imported, production, purposed, suggestion, recommend, several, cons, pros, suits, situation, implementing, solution, cover, understood, correctly, power, responsibility, active, filtering, etc, exploitation, tedious, task, protect, entry, validate, numerous, approaches, keeping, eye, trends, penetration, testing, daily, watch, tend, stuck, burp, suite, chances, someday, somehow, act, infrastructure, protection, main, large, number, organizations, specialized, july, vote, ofcourse, hand, dialogue, might, appscan, bet, engineers, surprised, coming, strategy, fact, believe, lack, capabilities, considered, risk, argue, black, among, corporations, scene, unfinished, broken, promise, destruction, portfolio, tractor, branching, features, commits, straight, master, review, integration, jira, computers, opportunities, readible, stamps, messing, creates, unreadible, classic, yes, everybody, likes, must, willing, due, uncertainty, modernized, gonna, question, upcoming, connect, voting, choice, newer, classes, shipped, questions, headed, over, won, upgrading, face, appear, portal, guess, intention, modernize, functionaly, smtp, according, currently, golden, generated, easy, adapt, implementation, however, nocastexception, tackling, checking, debugging, remained, switched, provider, immediately, warned, limitations, suggested, sensible, compared, requirements, nevertheless, came, same, entered, explained, mean, precedence, luck, suck, stumble, many, goodies, perform, above, views, validation, backslash, quotes, hopefully, solved, applying, regular, expression, during, improvements, selected, specify, enable, sending, notifications, weekends, updates, flexible, smaller, sets, imprt, biggest, instead, importing, per, day, scans, continuously, interval, handy, monitor, applied, turned, notify, previously, owner, responsible, sense, needed, down, collections, happening, initial, attempt, header, contains, finding, occurrences, rounding, pieces, charting, trend, occurrence, specific, dashboard, chart, adding, charts, videos, teachers, badges, weblog, home, primary,

Text of the page (random words):
t processing lifecycle it is commonly used for global tasks like url routing custom security checks application logging multi page error messages or dynamically altering themes and localization on the fly perhaps next image makes it clear when the phasetlistener runs exactly where we want it to be the steps to set it up are simple create a java class for it register the phaselistener for the phaselistener you want to run different scenarios so we will register the phaselistener first this is done in the faces config xml file for example good news is that the phaselistener will work on any type of xpage application so if you have vanilla xpage application with a document data source it will work if you have an advanced xpages application with a mvc architecture it will work for how the phaselistener to operate depends on your application here are some scenarios you don t want to run it on all xpages only on the xpages where the users normally enter the data and not the administration pages not accessible by them without special permissions otherwise the phaselistener is ignorant to what pages to work on you want to focus on the usual suspect input fields and skip radiobuttons or checkboxes don t forget hidden input fields you want to distinguish between special fields e g marked with a certain classname i do not know how your applications look like so we take this scenario with us what to sanitize do you want to allow some level of tagging or not your fields could be tied to a text editor that provides html tagging scenario 1 you don t want to run it on all xpages to define what pages i want to run the phaselistener on we will define a list with xpages to operate on to make clear these are the xpages text xsp forrm xsp and testbean xsp all other xpages are excluded by the phaselistener lateri could check what page is running and do or do not sanitize the data received scenario 2 the usual suspect input fields in our scenario we are only interested in the ordinary input text field and the textarea field scenario 3 special fields our xpages application is special so probably all fields are special but some fields are more special than others to only work on the more special fields we give them the styleclass property sanitize the phaselistener will identify them in the following way scenario 4 what to sanitize jsoup uses a safelist object to sanitize data and it comes with the following defaults none simpletext basic basicwithimages relaxed none for example trips all html in some cases you want to preserve some basic html tagging when connected to a text editor perhaps or with a textarea you want to preserve new lines play around and see what is suitable for you but for each type of control you can define custom formatting e g that is about it in the input setsubmittedvalue command we set the final data that the server should receive for starter code ask google ai for phaselistener xpages and you get starter code to work with regardless if you have a simple plain xpages application or an advanced one with a sophisticated mvc architecture you will notice that the phaselistener will sanitize the data received and you have implemented a security measurement application wide with only adapting the faces config xml file and writing an additional java class file happy secure development security jsf jsoup owasp sanitize xpages creating an sbom for a domino application and performing a security check on it 2026 june 8 2026 june 5 patrick kwinten leave a comment in a previous post i wrote about how to use the owasp vulnerability check to scan your domino application rather it s odp than the nsf for vulnerabilities and generate a report for it as you would expect there are more solutions for it and hcl has it s own ai powered offering for this but when you are in an evaluation stage or you want to more quickly try to integrate the creation of the sbom and vulnerability scanning into your cicd pipeline then take a look at syft and grype both opensource projects provided by anchore syft is here to generate an software bill of materials for you which can be described as a structured inventory listing all libraries packages and dependencies used in a piece of software grype will scan that software bill of materials for vulnerabilities so syft tells you what s in your software packages dependencies grype tells you what s wrong with those components vulnerabilities syft can create sboms from containers images and file directories so an odp shouldnt be any difficulty i will describe the steps i took to get some results the first step is to download both projects from github i downloaded the latest windows releases i started with the installation of syft to see how far i would come with creating an sbom as source i used once again my fun project available on openntf shameless plug and created a local odp from it i opened it in the terminal and started with c ws syft syft exe o cyclonedx json sbom json yeah it created me a sbom but is was not human friendly to read so i tried c ws syft syft exe o table which gave me a nice r table in the console to have it in a readable text file i tried then c ws syft syft exe o text sbom_readable txt which gave me the text file but still it was horrific to read i asked google for a template to generate a report in html and ran c ws syft syft exe o template t syft_report tmpl sbom_report html this gave me the following more promising and fancy file so half of the mission accomplished i then installed grype and try to run it via c ws grype grype exe sbom sbom json but it complained that it could not find a vulnerability database and that it ran into an error while trying to fetch one again the fire wall restrictions did not allow me to go outside the network so a similar procedure as with the owasp vulnerability check i had to follow install grype on a machine outside the network fetch the database amd transfer it via an usb stick to my corporate machine but to make sure that grype would not fall in its default behaviour of fetching the latest vulnerability database i had to set some environment settings note terminal session valid env grype_db_auto_update false env grype_db_validate_age false env grype_db_cache_dir c ws grype grype db where grype db is the folder where i transferred the vulnerability database to i once again asked google to provide me a template for generating the vulnerability report with and added that to project then i ran c ws grype grype exe sbom sbom json o template t template tmpl security_report html and the result report is pretty amazing if you click on the twistie before the file you get a distription of the issue with related urls and the vulnerability link brings you to the github advisory db with more details especially the severity state and fixed in are helpful and someone has to update that application with file on openntf so some consideration after this evaluation if you do not have the files in your nsf and therefor not in your odp you have a problem i am not sure if syft can also work with a pom xml file but you could build something that adds such a pom file to your odp resources from the server e g via the extension library linked resources in other nsf s or cdn s are also out of scope but we met that issue with the owasp check already the report can use a template so it is fully customaizable just add your company logo and start billing your customer it would be wise to introduce some sort of artifactory for your domino environment in which you store the jar files distributed on your servers and use that one as source for your sbom and vulnerability report with a greater wider overview you can better prioritize the most vulnerable files first perhaps beware this is an evaluation ran on a local machine i have not investigated that you can run it on other machines but it is powershell so you should be able to trigger it from lotusscript and perhaps build an agent to automate start collecting and scanning for you and mail the reports to you ideally you would like to include the vulnerability scanning as early as possible i would suggest before the developer merge any feature branch into the develop branch in git i was at a hcl braindump session once in stockholm where thomas hampel thought automating the build process was a great idea for domino development but this was years ago my advice is to give syft and grype a try and learn from the reports happy development uncategorized grype sbom syft vulnerability owasp vulnerability check on a domino application 2026 june 4 patrick kwinten 1 comment i was watching the video owasp top 10 the big picture on pluralsight in which the owasp vulnerability check ovc was mentioned and recommended so i wondered if this would be of interest for my applications whether you are just getting started a seasoned developer or someone who is curious about secure development the owasp foundation is here to help with open community supported projects like the owasp top 10 ordering the top security risks faced by application developers to the asvs providing guidelines for secure coding and application development you are sure to find something to inform your appsec process this course is an overview of the owasp top 10 and a few other flagship projects offered by owasp so here follows a descriptions of the steps i took to scan an nsf for vulnerabilities and my findings the first step was to download the zip file from github and extract it somewhere local on my machine make sure the lib folder is registered in your system environment and you have a compatibel java version installed 11 or higher i first tried a scan via the command line against an odp of an fun application available on openntf shameless plug i decided to listen to the warning and run with an api key otherwise the process would take considerable more time i was told the api key request form you can find here and the confirmation form here dependency check bat scan odp nvdapikey your_application_key_here i am running the command in the local git repo where the nsf design data is stored as an on disk project within the folder named odp i soon discovered that the corporate firewall was blocking access to update the national vulnerability database nvd so i had to find a work around basically installing ovc on a different windows machine update the nvd database there and transfer it via a usb stick with an updated nvd in place i initiated a new scan but with the parameter to skip to update the nvd dependency check bat scan odp nvdapikey your_application_key_here noupdate i once again was confronted being behind a firewall because i got an error message the the oss index could not be accessed this index is a secondary vulnerability resource as a complement to nvd this one you can not download locally because calls to it are being made request driven via a rest service the only option you have is to disable accessing the index via a parameter beware that your scanning becomes less secure and you will get a less complete report the oss index is more frequently being updated than the nvd so bare that in mind dependency check bat scan odp nvdapikey your_application_key_here noupdate disableossindex true so now i got a report a nice html file but i only noticed client javascript libraries being scanned i thought the application was using some jar files and it s an xpages application using the bootstrap theme in this case i removed the jar files from the design and stored them directly in the jvm lib ext folder so designer would pick them up this is also how we distribute jar files on the server never inside the nsf because this may lead some awkward side effects dependency check bat scan odp scan c ws program files x86 hcl notes jvm lib ext nvdapikey your_application_key_here noupdate disableossindex true so why not scan against the local ext folder additional then it turns out that ovd have difficulties with scanning the jar files that hcl provides for the client at least the check broke at the first file access bridge jar probably because this is hcl ip and not listed anywhere in the nvd so for sake of the evaluation i copied the required jar files to a tmp folder inside the odp if you happen to store the jar files inside the nsf under code jars then you don t have this worry so back to dependency check bat scan odp nvdapikey your_application_key_here noupdate disableossindex true which gave me a nice html file containing the report here are my findings as you can see there is a concern for the file you get a nice description details and recommendation s so this is a good step especially if you are downloading applications from openntf and you do not know what the ins outs of the code are and it has dependencies you better pre scan the nsf or it s odp there are though still some considerations left to investigate does the application use resources provided by the platform server like bootstrap jquery and dojo does the application consume resources perhaps provided by other applications or services cdn s files stored in other nsf s does the application uses server plugins and what do they contain like the debug toolbar or openntf domino api i hope this writing will provide you more food for thoughts regarding the safety of your applications platform and organisation happy development security jar owasp vulnerability replacing ckeditor with quill 2026 may 26 patrick kwinten leave a comment in some gray applications traditional domino applications who haven t become updated lately we have ckeditor 4 as rich text editor embedded ckeditor 4 reached its end of life in june 2023 so time for an upgrade if you can t run the open source license and need to avoid any priced license you need to search for alternatives alternative tinymce require your web forms to run in standards mode to run so you need to change the forms property to run on the web as html but then a form become static in other words you need to re think recreate your current domino forms alternative quill seems to be a bit more friendly to integrate without the standards mode first impressions are looking promising so let s share them first hurdle is perhaps how to download the distribution file without a package manager installed i used this link to download the files separate and stored them as files in the resources files section thereafter i added to a form the html and js to build up the page on the webqueryopen event of the form i referred to an agent which is not doing much but for demo purposes provides some default html for the quill editor and when you open the form you will see this so this looks at least like a start to see what is being stored i added in the webquerysave event of the form to run an agent the agent doesn t do much but you can do now whatever you want with the incoming perhaps sanitize it for example if you submit something as followed this would be the result so yeah we have the text innerhtml ...