How to prevent inline paste from executing html

[Benjamin]

Hello,

 

I am looking for help regarding preventing a kendo spreadsheet from executing html that is pasted into a cell.  I have tried $(document).on('paste', function () {}) and the kendo paste function prevent defaults, but neither or these worked.  Any suggestions?

Example:

Dojo: https://dojo.telerik.com/AjomeMOH/5

Paste value : <img src=x onerror=alert(123)>

 

Thanks

[Benjamin]

I figured it out.  Something within the init() of the paste command was causing this issue.  A workaround is to encode the text for the init() command and then decode it within the spreadsheet paste event.  see this Dojo for an example: https://dojo.telerik.com/AjomeMOH/23

[Ivan Danchev]

Hello Benjamin,

This is an interesting approach. Thank you for sharing it with the community. I am sure it will be helpful to anyone that faces this scenario.

Regards,
Ivan Danchev
Progress Telerik