We use cookies to give you the best experience on our website. If you continue to browse, then you agree to our privacy policy and cookie policy. Image for the cookie policy date

Big problem with all controls (XSS, but not only)

I have big problem with Syncfusion controls (e.g. with TextBox control).
When value in TextBox is </script> page output is completely messy.

Output from default Asp Net Core control is ok, but output from Syncfusion TextBox is "broken" - (like on screenshot below):


It's not only problem with <script> or </script> text. Single quotation mark (") can broke output. It's because your library generate javascript without escaping values from model fields. For example:

var TextBoxhjmrudszwgx=new ejs.inputs.TextBox({
  "enableRtl": false,
  "value": "</script>"
});
TextBoxhjmrudszwgx.appendTo("#editText"); 

Or for field value with quotation mark:

var TextBoxhjmrudszwgx=new ejs.inputs.TextBox({
  "enableRtl": false,
  "value": """
});
TextBoxhjmrudszwgx.appendTo("#editText"); 

In my opinion it should be escaped.

What am I doing wrong? What I have to do to make it work properly?

Ma sample project is in attachment.

Attachment: Xss_be9ec3e9.zip

2 Replies

Sureshkumar P October 16, 2019 12:51 PM UTC

Hi adgr, 

Greetings from Syncfusion support. 

We are validating your query and shared code block with image. We will update the further details in three business day (10/21/2019). We appreciate your patience until then. 

Regards, 
Sureshkumar P 



Sureshkumar P October 25, 2019 09:33 AM UTC

Hi adgr, 
 
Sorry for the delay. 
 
Query 1 : special character (*) issue  
 
we have ignore special character (‘,*) to use escape character to resolve the issue , please refer the below  
 
“\””   but it is not applicable script tag 
 
Query 2: value in TextBox is </script> page output is completely messy 
 
We have considered this as a bug and promised to provide fix in our volume 4 release, 2019 scheduled on December first week. Please find the reference links below    
    
 
Regards, 
Sureshkumar P 


Loader.
Live Chat Icon For mobile
Up arrow icon