[Solved] xss

[Oleg]

Hi,

I am using ComboBox and see that there is a possibility for persisted xss attack. It happens when clicking down in combobox to select a valule.


Here is an example demonstrating the issue.
Create a model with 2 properties:
    public Llist<SelectListItem> GroupList;
    public string SelectedGroup;


 <%Model.GroupList.Add(
    new SelectListItem {
        Text  = "Test<script>alert('i can haz your data');</script>",
        Value = "Test<script>alert('i can haz your data');</script>" }
); %>

<%= Html.Telerik().ComboBoxFor(x => x.SelectedGroup).
   .BindTo(Model.GroupList)
   .AutoFill(true)
   .HighlightFirstMatch(true)
%>

[Oleg]

Any chance this will be fixed anytime soon?

I can html encode values in the list before passing them into the combo box, but that will mean that I will have to html decode it, before using selected value.

[Georgi Krustev]

Hi Oleg,

We will investigate the issue and write you shortly.

Sincerely yours,
Georgi Krustev
the Telerik team

[Georgi Krustev]

Hello Oleg,

ComboBox UI components now encodes Text property of the DropDownItem. If you need to stop encoding you can use Encode() method.

I have attached latest internal build to this message. Check it and let me know if you encounter any problems with it.

Best wishes,
Georgi Krustev
the Telerik team