XSS attack by User input
https://snippet.webix.com/haopac8x
When click on “Click me to test” its trigger js script. How to prevent that ?
XSS attack by User input
https://snippet.webix.com/haopac8x
When click on “Click me to test” its trigger js script. How to prevent that ?
Hello duynq2197,
We have two ways to prevent such behavior:
format:webix.[template.escape](https://docs.webix.com/api___template_escape.html)
. You can specify it in any column you need.Please check the snippet with the example : Code Snippet
@Natalia_Shilova Thanks but I have one more problem.
How to apply it to all view: “datatable” in my APP because i use it in many screen
using webix.extend to modify datatable defaults
webix.extend(webix.ui.datatable, {
defaults: {
css: “test” // Apply CSS class ‘test’ to all datatables
}
});
I found this solution
Combine with first solution prevent XSS attack. We have:
// Extend the default configuration of datatable columns - Prevent XSS attack
webix.extend(webix.ui.datatable, {
$init: function() {
// Loop through all columns and apply the default format
this.attachEvent("onStructureLoad", function() {
this.config.columns.forEach(function(column) {
// If the column does not have a format set, apply webix.template.escape
if (!column.format) {
column.format = webix.template.escape
}
})
})
}
})
duynq2197,
This is a valid solution that will affect every datatable in the app. Thank you for sharing it!