RadMenu & Microsoft AntiXss 4.2.1

[Richard Weeks]

If I reference the AntiXss library (4.2.1) and then implement it through web config, e.g:

<system.web>
    <httpRuntime encoderType="Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary"/>
</system.web>

When rendered, the RadMenu presents all links as href="%23".

How can I ensure RadMenu operates normally after adding AntiXss?

Richard

[Peter]

Hello Richard,

The problem is not with RadMenu. You can test a regular HyperLink and its NavigateUrl value will also get corrupted:

* * *

 <asp:HyperLink Text="aaaa" NavigateUrl="http://www.google.bg/" runat="server"></asp:HyperLink>

* * *

You can try to workaround the issue with the client API of RadMenu:

<script type="text/javascript">
        function OnClientLoad(menu) {
            var items = menu.get_allItems();
            for (var i = 0; i < items.length; i++) {
                var currentItem = items[i]
                currentItem.set_navigateUrl(currentItem.get_navigateUrl());
            }
        }
    </script>
    <telerik:RadMenu ID="RadMenu1" runat="server" OnClientLoad="OnClientLoad">

Kind regards,
Peter
the Telerik team

[Richard Weeks]

It's a bug. Damn, there goes my AntiXss till they get a patch out :(

Richard