Problem with html attributes processing in Editor in viewHtml mode

4 posts, 0 answers
  1. Hans
    Hans avatar
    28 posts
    Member since:
    Mar 2011

    Posted 14 Sep 2015 Link to this post

    I got a problem with attributes processing in viewHtml mode

    There is steps to reproduce:

    1. Create Editor with "viewHtml" button

    2. Open "View Html" dialog by clicking on "View Html" button

    3. Put the html code as below:

        <img height="157" width="314" on="" k-script-on="" />

    4. Click on Update button

        Uncaught TypeError: Cannot read property 'nodeName' of undefined

        in _preventScriptExecution function

     

    The ​bug is in processing of attributes: on="" k-script-on="" 

    When the code below is run

        this.setAttribute("k-script-" + name, attribute.value);

    the "attributes.length" changing and the variables "i" and "l" is wrong

     

    Is it posible to fix it?

  2. Dimo
    Admin
    Dimo avatar
    8332 posts

    Posted 16 Sep 2015 Link to this post

    Hello Hans,

    The problem is caused by the fact that a combination of "on" and "k-script-on" attributes are used. The Editor's logic is to replace all "on...." attributes with "k-script-on..." attributes. Since the latter attribute already exists, it is removed, which changes the attribute count on the fly.

    The "k-script-on" attribute is for internal use and should normally not be used by the end user. Can you describe a valid scenario, in which the described issue occurs?

    Regards,
    Dimo
    Telerik
    Join us on our journey to create the world's most complete HTML 5 UI Framework - download Kendo UI now!
  3. Kendo UI is VS 2017 Ready
  4. Hans
    Hans avatar
    28 posts
    Member since:
    Mar 2011

    Posted 18 Sep 2015 in reply to Dimo Link to this post

    Thank you for response

    >>Can you describe a valid scenario, in which the described issue occurs

    For example user can open some site in html mode and copy some html code with "on...." , "k-script-on..." attributes. Pasting of this html code is broke the kendo editor.

    I understand "k-script-on" attribute is for internal use, but we creating a stable app/site and should expect any attributes from user, 

    and that is why we expact from kendo editor checking of this behavior. It seem we can't fix it outside of kendo editor, so Is it posible that kendo team will provide a fix for it in future?

     

    Thanks

  5. Dimo
    Admin
    Dimo avatar
    8332 posts

    Posted 23 Sep 2015 Link to this post

    Hello Hans,

    I am afraid we do not regard the described scenario as valid or plausible, for a couple of reasons:

    - an on="" HTML attribute does not exist;
    - a k-script-on="" HTML attribute does not exist. It is created and used by the Editor temporarily on the client, and is never submitted to the server or included in the returned widget's value;

    Even if we replace "on" with another valid "onfoo" attribute (e.g. onclick), the probability for the user to paste code with both onfoo and k-script-onfoo attributes applied to the same element is practically zero. Moreover, this represents an unsupported scenario, because the k-script-onfoo attribute will be lost when the onfoo attribute is renamed.

    The Javascript error itself is caused by the fact that the attributes collection size is cached for performance reasons, which is a good practice when the iterated collection's size is not expected to change.

    Regards,
    Dimo
    Telerik
    Join us on our journey to create the world's most complete HTML 5 UI Framework - download Kendo UI now!
Back to Top
Kendo UI is VS 2017 Ready