I have big problem with Syncfusion controls (e.g. with TextBox control).When value in TextBox is </script> page output is completely messy.
Output from default Asp Net Core control is ok, but output from Syncfusion TextBox is "broken" - (like on screenshot below):
It's not only problem with <script> or </script> text. Single quotation mark (") can broke output. It's because your library generate javascript without escaping values from model fields. For example:
var TextBoxhjmrudszwgx=new ejs.inputs.TextBox({
"enableRtl": false,
"value": "</script>"
});
TextBoxhjmrudszwgx.appendTo("#editText");
Or for field value with quotation mark:
var TextBoxhjmrudszwgx=new ejs.inputs.TextBox({
"enableRtl": false,
"value": """
});
TextBoxhjmrudszwgx.appendTo("#editText");
In my opinion it should be escaped.
What am I doing wrong? What I have to do to make it work properly?
Ma sample project is in attachment.
Attachment:
Xss_be9ec3e9.zip
