[CLOSED] XSS Security Issue with Ext.net

[RajivDutt]

http://mvc.ext.net/#/GridPanel_Plugins/CellEditing/

Goto any cell and type <plaintext>
It will show some scripts in the grid.

Thanks,
Rajiv Dutt

[geoffrey.mcgill]

http://mvc.ext.net/#/GridPanel_Plugins/CellEditing/

Goto any cell and type <plaintext>
It will show some scripts in the grid.

Thanks,
Rajiv Dutt

I'm not too sure how this is a XSS issue?

[RajivDutt]

Ok, what type of issue is this? Is it desired functionality of the grid?

[Vladimir]

XSS is vulnerability enables attackers to inject html or client-side script into pages viewed by other users.
In the example you inject html to own page, it is not XSS. If you plan to show that editable to othher users then you have to check submitted data manually (by default, ASP.NET raisea an exception that submitted content is dangerous)

GridPanel displays content from editor as is. If you want to use html data in the grid then encode content in Renderer

<Renderer Format="HtmlEncode" />