Q&A

Is there a way to change the Font Size or Font Type on the Iframe for Confluence Macro?

The styling would need to happen on the original page. This type of change is prohibited by browsers as it would violate CORS. The style you can configure on the macro impacts the iframe itself and is used for things like sizing.

As an alternative, you could adjust the width and height attributes of the iframe, but what happens within that is up to the CSS of the remote site in terms of styling.

We are searching for apps that are more secure than the embedded iframe solution of confluence, since it can make Confluence vulnerable to cross-site scripting attacks. Is this app a good alternative considering the security aspects? Could we have security concerns with this app?

They’re as secure as the configuration which you set on the iframes and the browser that enforces them.

We can’t make any broad statements here, but you’re welcome to trial the app and attempt to attack Confluence on a test page.

Does your add on support limiting who can insert/edit HTML into a Confluence page? We are looking for a way to limit that. The people who cannot insert/edit will still need to be able to view the HTML code inserted on the page.

We do not have controls on who can create a macro. Unfortunately there’s no method which would enforce this.

Can you elaborate on the statement of how the Secure HTML Macro makes running HTML code safe?

What this means is that the macro wraps the code in an iframe with a domain we control to trigger CORS protections, and the sandbox attribute.

Then when browsers interpret this, they apply a number of client side protections to ensure that security risks like XSS are mitigated.