Oracle BAM – Designing Custom HTML Report

Question

Hello,
I read an article about designing custom HTML reports   http://www.oracle.com/technetwork/middleware/bam/technote-bam-customhtmlreport-131058.pdf . In my situation , I want to use circle instead of table to display data values. How can I do that ?     Can I use JavaScript in the HTML String ?

Answer 1

Update:
This is interesting. So when my coworker asked me how get the tooltip effect, I said it was super straight forward. All they had to do was something like:
<span title="My tooltip">My Column Header</span>
And it would work. After trying all kinds of HTML, I despaired of a simple fix.
Then we set the HardenXSS flag to false in the server instance config file, and I tried that exact code again. It still was not parsing the column header correctly. Then one of my other coworkers, tells me that he put a line break tag in, and it rendered the break.
o.O
So I tried the following:
<b title="My tooltip">My Column Header</b>
Which of course worked. Why is span being discriminated against? I have no idea.
So basically, for column header tooltips, disable XSS hardening, and use a bold tag. (why bold? it was the first thing that came to mind, and since the default font-weight of a table header is bold, it should be practically unnoticable).
The next question is, what exactly is the impact of disabling the HardenXSS. I'm not sure if it allows certain HTML elements only, or if it allows any HTML (or more to the point the script tags). I wonder if anyone has done a vulnerability assesment of having hardening turned off.
--james
Message was edited by:
jholder
Message was edited by:
jholder
Fixed html entities