Overview

In ST 5.4 P47 and in ST 5.3.6 P53, the third-party jQuery library is upgraded from version 3.4.1 to 3.5.1. The upgrade fixes critical security vulnerabilities but also introduces a breaking change where invalid HTML code may no longer render.

Due to this change, after installing ST 5.3.6 P53 or ST 5.4 P47, the UI pages of the custom-developed plugins that contain invalid HTML will not be loaded in the SecureTransport Administration Tool. Customers, who use custom connectors or Advanced Routing step plugins, need to check their page source for malformed HTML and fix it if needed.

Problem

The following symptoms might be observed:

A custom developed Advanced Routing step page is not displayed in the SecureTransport Admin UI.

When a pluggable transfer site is selected from the drop-down menu on the Transfer Sites page, its page is not displayed.

Solution

Fix any invalid self-closed HTML tags in the plugin's source code. Follow the below steps.

Procedure

1. Locate the HTML file which is loaded in the SecureTransport Administration Tool

For each custom plugin, there is a jar file containing its implementation.

For Pluggable Transfer Sites:

The jar files for Pluggable Transfer Sites are located in ${FILEDRIVEHOME}/plugins/transferSites where ${FILEDRIVEHOME} represents the SecureTransport installation directory. The jar file contains plugin implementation and, depending on the SPI version, a Plugin-Info.yaml or MANIFEST.MF file inside the META-INF directory.

For plugins using SPI 1.1 and above, locate the META-INF/Plugin-Info.yaml file. The location of the HTML file is shown in the CustomUI property.

For plugins using SPI 1.0, locate the META-INF/MANIFEST.MF file. The location of the HTML file is shown in the CustomUI property.

For Custom Advanced Routing Steps:

The jar files for custom AR steps are located in ${FILEDRIVEHOME}/plugins/routingSteps where ${FILEDRIVEHOME} represents the SecureTransport installation directory. The HTML file is located in the /html folder in the plugin jar.

2. Check the HTML file for incorrect self-closed HTML tags

Incorrect self-closed HTML tags are, for example, <span/> instead of <span></span>. To determine if there are such tags, you can use an HTML validator or a regex tool with the following expression:

/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi

3. Fix the incorrect self-closed tags in the HTML file and save the changes

Examples:

4. Fix the dynamically-generated HTML tags

If your plugin uses static HTML, then properly closing the tags should fix the issue. If the HTML is generated dynamically, a code processor may self-close empty tags without content. In such cases, you can put HTML comments inside the tags to prevent the self-closing:

<a><!-- empty --></a>

5. Build and deploy your plugin to SecureTransport

In a cluster environment, the custom plugin jar file must be deployed on all cluster nodes.

6. Restart the SecureTransport Admin and Transaction Manager services