Metadata Fields: Support HTML Tags

[eaquigley]

From General UI Doc: https://docs.google.com/document/d/1VXac5Eqx1LDVWvMogf4EYVfxv-9gIavgAnL4x_esiTI/edit

@mcrosas comment: Some (or all) metadata field values need to support a few basic html tags (for links, breaks, bold, italic)

@mheppler comment: This goes all the way back to our initial 4.0 UI brainstorming sessions, where we wanted OpenScholar-WYSIWYG type input fields with common styling controls. PrimeFaces has an Input Editor component that provides this.

[mheppler]

I am not sure that I can wire up these PrimeFaces Editor widgets into the metadata input fields.

http://www.primefaces.org/showcase/ui/input/editor.xhtml

I am passing this to @scolapasta to review. If he feels that this is simple enough for me to tackle, with a little direction, I am all for it.

[mheppler]

Related to #241 and #610.

[pdurbin]

I understand that in DVN 3.x we allowed users to enter HTML into certain fields and there is a migration task to make sure those fields full of HTML are properly migrated over.

However, I question this feature of allowing HTML input at all. It was probably a fine choice when DVN was started many, many years ago but what many sites seem to support these days is not HTML input but rather a lightweight plain text markup language such as Markdown.

Markdown is supported by GitHub in this very form I'm writing into. It's also supported by Stack Overflow, Trello, and Reddit, to name a few. What if Dataverse 4.0 allowed input in Markdown?

There are even WYSIWYG editors for Markdown such as https://github.com/benweet/stackedit used by Stack Overflow. On the server-side, https://github.com/sirthias/pegdown seems like a nice Java library we could use to render the Markdown into HTML.

For migration, maybe we could convert existing HTML into Markdown.

I'm not trying to complicate things, but again, I think we should consider supporting Markdown rather than HTML.

[bencomp]

Maybe you don't even need to convert existing HTML to Markdown: http://daringfireball.net/projects/markdown/syntax#html says you can mix and match if you want.

[scolapasta]

#610 and #239 are directly related, so copying notes from there, so I can send those to QA as dupes:

---

#610

Things to consider:
*if we allow links in metadata fields, we should have a link checker that could provide notifications when links break
*Potential PrimeFaces widget to use for fields that can use HTML (i.e.-description): http://www.primefaces.org/showcase/ui/input/editor.xhtml

---

#239

We should probably limit the HTML tags we allow in dataverse and dataset metadata fields to things like

, , , etc. and not

, , etc. This is limit the damage to the UI that allowing any and all HTML tags in those fields can bring upon the page. I believe that OpenScholar does something like this.

[pdurbin]

We should probably limit the HTML tags we allow

Here's the list of HTML tags GitHub allows: https://github.com/github/markup#html-sanitization

[sekmiller]

@kcondon
here are the whitelisted tags:

    // basic includes: a, b, blockquote, br, cite, code, dd, dl, dt, em, i, li, ol, p, pre, q, small, span, strike, strong, sub, sup, u, ul
    Whitelist wl = Whitelist.basic().addTags("img", "h1", "h2", "h3", "kbd", "hr", "s", "del");   

[kcondon]

OK, tested dv descript, dataset descript and notes, and tou, toa all work, sending back to in review.

OK, works, the following rules were tested:
// basic includes: a, b, blockquote, br, cite, code, dd, dl, dt, em, i, li, ol, p, pre, q, small, span, strike, strong, sub, sup, u, ul
Whitelist wl = Whitelist.basic().addTags("img", "h1", "h2", "h3", "kbd", "hr", "s", "del");

I just entered blank tags and watched if they survived as tags on a rendered page:
Basic:

Whitelist:

h1

h2

h3

---

Blacklist:

<script></script>

[mercecrosas]

@scolapasta we need different HTML validation for different metadata fields (probably this needs to be an attribute in the metadata table). Note the high priority for this, can this be added to 4.0.1 or 4.0.2?

[raprasad]

Mike added a checklist for this process here: https://docs.google.com/document/d/1GNZtAgI7vD8jGnSMT2_Ew1SJtnDzRqpfnqa0JGPOiqY/edit

[mheppler]

We should also look into the attributes for HTML elements. In issue #2114 there is a layout issue on the dataverse page due to an align attribute in an image tag.

it appears that the align="left" attribute and property of the image is what is causing the layout issue

[mheppler]

Discussed the WYSIWYG editors that OpenScholar uses. They currently use an older version of TinyMCE, but are changing to CKEditor because they looked at what Drupal 8 uses and chose that.

[michbarsinai]

Trix (https://github.com/basecamp/trix#readme) might be interesting as well. Open source, used in the upcoming Basecamp. Haven't tried it myself.

[pdurbin]

What is the definition of done for this issue? Dataverse has supported HTML in metadata fields since Dataverse 4.0 (and maybe earlier). Vote to close.