JavaScript injection problem

[Politzki Oliver]

Hi there,

one can inject harmful or bad JavaScript code in most of the Syncfusions controls.

It's even working here in this box ;)

The same can be achieved here: https://ej2.syncfusion.com/vue/demos/#/material/grid/inline-editing.html (editing an entry)
Here: https://ej2.syncfusion.com/vue/demos/#/material/grid/dialog-editing.html
And here: https://ej2.syncfusion.com/vue/demos/#/material/tooltip/api.html

See attached gifs for clarification.

Best regards,
Oliver

[Politzki Oliver]

Added missing gifs

Attachment: javascriptinjections_b7d21bca.zip

[Gurunathan A]

 Hi Oliver,  

Thanks for reporting this issue, we will resolve the reported issue in our components and get it fixed in upcoming patch release.  

You can track through this feedback link.  

https://www.syncfusion.com/feedback/9486/security-issue-in-e2-controls 

Please let us know if any concerns.  

Regards, 

Gurunathan