How to Detect Unsafe HTML in Power Automate

HTML often moves through Power Automate as part of a larger workflow. It might come from a formatted email body, a Power Apps or Dataverse rich text field, a webhook payload, or even a document generation step. Most of it is harmless, but when that content comes from inputs like email, external forms, user editable fields, etc., it can also contain unsafe markup like script tags, JavaScript links, and other cross-site scripting (XSS) patterns.

Implementing HTML Threat Detection in Power Automate

Thankfully, Power Automate’s connector library has solutions for almost any problem you can think of. Below, we’ll learn how to detect XSS content in a quick, manually triggered flow using a multi-security-threat detection action available in the premium Power Automate library.

We’ll begin by creating a Manually triggered instant cloud flow. This is ideal for testing purposes; in a real workflow, this same HTML could come from a previous step, like an Outlook email body.

Next, we’ll search for Cloudmersive connectors in the Power Automate library and locate the Cloudmersive Security connector.

From the actions list, we’ll select the action called Automatically detect threats in an input string, and we’ll then create our connection with a Cloudmersive API key. We can get one by creating a free account on the Cloudmersive website (this will allow up to 800 API calls/month with no commitments).

Next, we’ll pass our HTML file content into the User-facing text input field. Note that even though the dynamic content from our trigger step is labeled as “content bytes”, it’s actually just HTML text content being passed into the action.

Now we’ll test our flow with an example HTML file. The one we’re using here has a variety of (inert) XSS threats baked in.

When our flow finishes running, we’ll find the result of our multi-security-threat scan in the output.

We’ll notice that CleanResultreturned false, and ContainedXssThreat returned true. The action identified dangerous content in our HTML file and flagged it right away.

Notice that it’s also looking out for JSON Insecure Deserialization, XML External Entities, SQL Injection, and Server-Side Request Forgery threats. It’s even validating whether the input is XML, JSON, or a URL. While some of these additional threats aren’t likely to show up in a Power Automate context, it’s always great to have additional protection against unpredictable external inputs.