How to restrict Grid Row Editing XSS (Cross site scripting)

820

Ben Hull posted over 1 year ago

hi all
I am looking for a way to sanitize inputs to keep script from being executed when editing grid records.

If i add something simple as '<img src=z onerror=alert(278)>' into an rowEdit input, the script will execute. Is there a simple or native option to restrict or treat input values as text?

Top Replies

660

Offline Riva Ivanova posted over 1 year ago +1 verified
Hello Ben, Thank you for posting into our community! I have been looking into your question and an approach I could suggest is using the editCellEnding...view reply »
820

Offline Ben Hull posted over 1 year ago in reply to Riva Ivanova +1 verified
ok thanks I wasnt sure if there was something native or an option to enable. I went with the full rowEditEnding approach and check if the value is a typeof...view reply »