Announcement

Collapse
No announcement yet.
X
  • Filter
  • Time
Clear All
new posts

    HTML Escaping issues

    Hi, I'm seeing a few issues trying to display data from TextAreas that could include html.

    First, I noticed that Firefox and IE are acting a bit differently with SmartClient for one usecase. If you go here: http://www.smartclient.com/docs/6.0/a/system/reference/SmartClient_Explorer.html#customEditors and then enter in the following to the Japan row on the Govt column:
    Code:
    constitutional monarchy with parliamentary government <script>alert('hi Japan');</script>
    ..then, when you click away from the row, it will fire off that script and display an Alert one time (and only one time). Try the same thing in IE and it never fires. I'd prefer if Firefox didn't fire off the alert at all.

    Second, is there a property to set that controls whether or not html or javascript inside a textarea is escaped or not when viewing a grid? I see that inserting html into textareas always displays html formatted text in a grid but, in some cases, I'd prefer to display the raw html to the user or escape the html inside a grid.


    Finally, I have text I want to display in hovers that could contain html. I'd like this text to escape all HTML. So, I'm now using this stripTags function to make that happen. Is there any other recommended approach for doing this with SmartClient?
    Code:
      function stripTags(str) {
        return str.replace(/<\/?[^>]+>/gi, '');
      }

    #2
    Hi senordhuff,

    Wherever you do not want HTML to be allowed, you are generally expected to use server-side HTML stripping and escaping techniques. As with ordinary non-Ajax web applications, enforcement has to be server side.

    Your approach to stripTags is a reasonable way to disable all HTML tags in a piece of content where they are otherwise allowed.

    Comment

    Working...
    X