This is a migrated thread and some comments may be shown as answers.

[Solved] Custom command & html encode ?

0 Answers 10 Views

Grid

This is a migrated thread and some comments may be shown as answers.

This question is locked. New answers and comments are not allowed.

Adam asked on 19 Dec 2012, 03:25 PM

I've noticed that making custom command in the grid, there's no way to html encode the text - this makes some xss possibilites.

Html.Telerik().Grid<EnterpriseViewModel>()

.Name("EnterprisesGrid")

.DataBinding(dataBinding => dataBinding.Ajax().Select("AjaxEnterprisesToChooseListShow", "Home"))

.HtmlAttributes(new { style = "height:100%;" })

.DataKeys(x => x.Add(m => m.EnterpriseId))

.Columns(columns =>

{

columns.Bound(o => o.EnterpriseId).Visible(false);

columns.Bound(o => o.Name);

columns.Bound(o => o.City);

columns.Bound(o => o.Address);

columns.Command(commands => commands

.Custom("Select")

.Action("SetEnterprise", "Home")

.DataRouteValues(x=>x.Add(m=>m.Name))

.Text(SharedResources.Select))

.Width(100);

})

.ClientEvents(events => events

.OnDataBinding("gridOnDataBinding")

.OnDataBound("gridOnDataBound")

.OnRowSelect("gridOnRowSelect"))

.Selectable(c => c.Enabled(true))

.Sortable()

.Pageable(page => page.PageSize(10))

.Render();

If I have Enterprise.Name =

NAME"> XSS attack

the code above will generate

<a href="/Home/SetEnterprise/30?EnterprisesGrid-page=1&EnterprisesGrid-orderBy=&Name=NAME"> XSS attack" class="t-button t-grid-Select" >Select</a>

Is there some way to encode the DataRouteValues before attaching it to the link? now it seems like it's done the other way around.