Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Error when creating KPI and load it

adriencosson
Valued Contributor
Valued Contributor

Hello folks !

After enabling the Add / Edit KPI, I would like to create a new KPI on the HomePage to view the number of Analytics available to the loggedin user.

Configuration is as following :

adriencosson_1-1683641146987.png

When saving the KPI, it triggers a flow, I am getting an exception that indicates "Access Denied due to XSS" :

adriencosson_3-1683641242314.png

I got from support team that some characters were not allowed in JS, but could not get more details.

Any chance someone can help troubleshoot the below JS script :

 

() => {
  const [widgetdata, setWidgetData] = useState({});
  useEffect(() => {
    const endPoint =
      "/ECM/api/v5/fetchControlListES";
    fetch(endPoint, {
      method: "GETWITHBODY",
      headers: { "Content-type": "application/json", "X-NOLOADER": true },
      body: JSON.stringify({"loggedinuser":userName,"offset":"0","max":"1"}),
    }).then((d) =>
      d.json().then((data) => {
        setWidgetData(data);
      })
    );
  }, []);
  return (
    <a href="/ECM/analyticsHistoryES/analyticsSummary?flatHistoryConfig=1">
      <h6 className="status-Tile">
        {intl.formatMessage({ id: "Available Reports" })}
      </h6>
      <div className="status-Tile-Data">
        <h6 className="status-count">{widgetdata.totalCount}</h6>
      </div>
    </a>
  );
};

 

 

Regards,
Adrien COSSON
7 REPLIES 7

saikanumuri
Saviynt Employee
Saviynt Employee

Hi Adrien,

I am checking on this internally and will get back to you

adriencosson
Valued Contributor
Valued Contributor

Hello,

Unfortunately I could not pull out any log for this issue as it looks more of a front-end issue where some characters might need to be escaped.

Please advise and provide a working example. Also you can use the above JS script in order to replicate internally.

Regards,
Adrien COSSON

Darshanjain
Saviynt Employee
Saviynt Employee

Hi @adriencosson 

Thanks, i am internally checking on this and will provide you an update soon.

 

Thanks

Darshan

nimitdave
Saviynt Employee
Saviynt Employee

With coming 23.6 release, the option to add a new Key Performance Indicator (KPI) from the Home page has been removed. You can only edit or delete an existing KPI. This change has been made to simplify the KPI management process. 

In the Edit option only feature option is editable.

adriencosson
Valued Contributor
Valued Contributor

Hello @nimitdave,

Therefore, this feature that was in Beta mode for creating KPIs will be decommissioned.

Still for editing, I would need to understand why are we getting the "Access Denied due to XSS" exception above.

Regards,
Adrien COSSON

Hi @adriencosson 

from 23v html tags are not supported, so even in the kpi its effecting , we have a internal jira which needs to be allowed for these tags so that it will work.

For time being there is no way to create/update Kpi due to the XSS error.

 

Thanks

Darshan

adriencosson
Valued Contributor
Valued Contributor

Hello @Darshanjain ,

For your information, we got from support the list of prevented patterns for XSS.

As you might be able to see : the following pattern means "anything"  (.*?) and therefore we simply cannto insert any "scope" data. If this one is getting removed then Create/Update KPI would have been possible.

I'm in touch with Support as well to get progress through FD ticket.

Regards,
Adrien COSSON