Disabling HTML Sanitization

What the HTML sanitizer does and why it has been enabled?

The HTML sanitizer is designed to detect certain types of HTML tags that OneTrust’s Security team has determined could carry risks associated with cross-site scripting.

The use of this HTML sanitizer is to ensure that malicious and unwanted code is removed from your tenant, and it will ensure protection against security concerns such as cross-site scripting attacks by sanitizing HTML markup in HTML fields and translated HTML fields. When the HTML sanitizer detects certain types of HTML tags (such as onclick events) that OneTrust’s Security team has determined to be high risk within a template, the user will be prevented from creating, updating or saving that template. The continued enablement of the HTML sanitizer is strongly recommended by OneTrust.

The sanitizer is enabled by default for all modules. By keeping the sanitizer enabled, HTML fields/tags that can be used to run unwanted scripts on your tenant or direct your users to malicious or unwanted content will be removed and only safe tags associated with creating, editing and saving cookie templates will be preserved.

Choosing to keep the HTML sanitizer enabled

The HTML sanitizer is in place by default and site users are blocked from saving templates if they include HTML tags.

What are the risks of not having the sanitizer enabled?

Cross-site scripting (XSS)

There is a risk that a user with access to your OneTrust account could add a malicious HTML link within a cookie banner template and publish that template on your website. An end user visiting your website could click on that link thinking that it is a legitimate link. As a result, this could compromise end users’ security and data. Click on the link below to obtain further technical details about XSS – you will be re-directed to a third-party website.

Cross Site Scripting (XSS)

Failure to pass penetration tests

Penetration tests (Pen-Tests) are an essential component of any Information Security Management System (ISMS). Disabling the sanitizer could cause a XSS vulnerability to be detected by a Pen-Test, which will result in failure to comply with data protection laws and with international frameworks such as ISO 27001 and NIST.

Is it possible for customers to disable the sanitizer?

As the data controller and administrator, you may determine if you would like to keep the HTML sanitizer enabled or if you would prefer to have it removed.

OneTrust as a data processor has incorporated the sanitizer by default to ensure compliance with security requirements of applicable data privacy legislation and related international frameworks, and to ensure it complies with its requirements as a processor by assisting our customers (data controllers) to ensure adherence to appropriate technical and organizational measures.

However, these measures are not unilaterally imposed by OneTrust. It is possible for customers to disable the sanitizer and accept the risk that comes with it (i.e. the risks to end-user security and the risk of non-compliance with data protection laws and international frameworks).

Whilst the sanitizer can be removed, this functionality (removing the sanitizer) is limited to the CMP Cookies module, and can only be removed at the module level with the following restrictions:

• Only Site Admin users will be able to accept the risk for their tenant (by navigating to Global Settings > Cookie Consent). This reduces risk by limiting the number of people and roles within an organization that can remove the sanitizer.

• Once accepted, the sanitizer will only be disabled for APIs related to creating, updating or saving templates on the Cookie Consent module.

Record of acceptance (enabling/disabling) will be stored (along with the user, and date and timestamp) to keep track of any and all changes to the sanitizer.

Behavior after a Site Admin user has accepted risk

A "risk acceptance" flag is stored in the tenant's database to confirm that the sanitizer can be bypassed. When another user saves a template that has HTML tags, we check for the flag and if present, bypass the sanitizer. The sanitizer will only be bypassed for APIs associated with editing and saving templates and will remain in place for all other APIs where we aren't aware of any valid customer use cases for disabling.