For setHTML() method, is it still safe If we do not use Safehtml but we validate the String & only accept some limited html tag (Gwt)? -

any widget has sethtml method give hole in security system, if validate string & accept limited html tags such <b>, <i>.... , put string sethtml method.

then question "is still safe if that" example, check string text make sure contain limited html tags <b>, </b>, <i>, </i>... if string text contain other tags won't let uses input text. use: html1.sethtml(text); instead of html1.sethtml(safehtmlutils.fromstring(text))

i don't know why html1.sethtml(safehtmlutils.fromstring(text)) not generate formatted text, shows plain text when run in eclipse? example

html1.sethtml(safehtmlutils.fromstring("<b>text</b>"))  

will have plain text result <b>text</b> instead of bold text "text" correct html format

you want sanitize html, not escape it. fromstring method meant escape string - if user types enters a < b, forgets space, adds >c, don't want c bold , b missing entirely. escaping done render string given, assuming text.

on complete other end of spectrum, can use fromtrustedstring tells gwt absolutely trust source of data, , allow anything. typically should not done data comes user.

somewhere off side of of have sanitation, process take string meant html, , ensure safe, rather either treating text, or trusting implicitly. hard - tag has style attribute potentially attack (this why gwt has safestyle safehtml, tag has uri, url or href used attack (hence safeuri), , attribute browser treats callback such onclick or can used run javascript. htmlsanitizer type meant able this.

there built-in implementation of this, of @ least gwt 2.4 - simplehtmlsanitizer. class whitelists html tags, including <b> , <i> tags, few others. attributes removed, there many cases might not safe. class name suggests, simple approach problem - more complex , in-depth approach might more true original code, comes risk of allowing unsafe html content.