Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ROU-11001: Added sanitizeInputValues configuration #431

Merged
merged 6 commits into from
Aug 21, 2024
Merged

ROU-11001: Added sanitizeInputValues configuration #431

merged 6 commits into from
Aug 21, 2024

Conversation

gnbm
Copy link
Collaborator

@gnbm gnbm commented Aug 20, 2024

This PR is for adding the new sanitizeInputValues configuration.

What was happening

  • When passing HTML to the Grid, mainly on Action and Image Columns and the ContextMenu., we opened a door to an XSS vulnerability.

What was done

  • Added a new sanitizeInputValues configuration to allow the developer to control when to sanitize the Grid's data.
  • The default will be sanitizeInputValues = true so this will be a needed breaking change.

Test Steps

  1. Open a screen with a Link Column
  2. On the Get From Other Sources add to the first position the following text Test <img src=x onerror='alert(String.fromCharCode(88,83,83))'>
  3. Check that now we can see the text and no code is executed

Screenshots

  • Before:

image

  • After the fix:

image

Checklist

  • tested locally
  • documented the code
  • clean all warnings and errors of eslint
  • requires changes in OutSystems
  • requires new sample page in OutSystems

@gnbm gnbm added the chore label Aug 20, 2024
@gnbm gnbm marked this pull request as ready for review August 20, 2024 10:46
@gnbm gnbm requested a review from a team as a code owner August 20, 2024 10:46
@gnbm gnbm requested a review from rugoncalves August 20, 2024 12:20
rugoncalves
rugoncalves previously approved these changes Aug 20, 2024
rugoncalves
rugoncalves previously approved these changes Aug 21, 2024
Copy link

Copy link
Contributor

@rugoncalves rugoncalves left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good!

@gnbm gnbm merged commit 0844059 into dev Aug 21, 2024
13 checks passed
@gnbm gnbm deleted the ROU-11001 branch August 21, 2024 17:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants