New StripJavaScriptUris Content Filter

[Mark]

2025 Q4 Release strips inline base64 encoded image source by default. 

With the introduction of the new StripJavaScriptUris content filter that is enabled by default as part of the DefaultFilters,  we are seeing inline base64 encoded image source data completely erased. 

For example an image that looks like this:

<img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAAEAYABgAAD//gAfTEVBRCBUZWNobm9sb2dpZXMgSW5jLiBWMS4wMQD/...." />

becomes

<img src="" />

Is this the intended behavior for this content filter?   

I was able to correct this by adding the following attribute to my <telerik:RadEditor> tag:

ContentFilters="RemoveScripts,StripDomEventAttributes,EncodeScripts,StripCssExpressions,FixUlBoldItalic,IECleanAnchors,MozEmStrong,ConvertTags,ConvertFontToSpan,OptimizeSpans,ConvertToXhtml,IndentHTMLContent,ConvertCharactersToEntities,RemoveExtraBreaks"

Essentially its the same as DefaultFilters, minus the new StripJavaScriptUris.

Please advise...

-Mark

[Rumen]

Hi Mark,

Thank you for reporting the issue. I have good news that it is already fixed and it will be addressed with the service pack release scheduled for next week: https://feedback.telerik.com/aspnet-ajax/1705491-stripjavascripturis-filter-incorrectly-strips-base64-encoded-image-data-uris. 

The current behavior you are seeing - where inline base64 image data URIs are stripped and the src attribute becomes empty - is not the intended behavior of the StripJavaScriptUris filter. The upcoming service pack includes the fix so base64-encoded image sources will no longer be removed.

Until the service pack is released, you can disable the filter by adding the following line to your Page_Load event:

protected void Page_Load(object sender, System.EventArgs e)
{
    RadEditor1.DisableFilter(EditorFilters.StripJavaScriptUris);
}

Your workaround of explicitly specifying the content filters minus StripJavaScriptUris is also valid, but disabling the filter in code-behind is a simpler interim solution.

Let us know if you need any additional assistance.

 

Regards,
Rumen
Progress Telerik