Aspnetcore.docs: JQuery and XSS

[jamesjardine]

I know the focus is on the API, but when I put this together and added the JQuery front end, I noticed that the todo name is not being encoded and is vulnerable to cross-site scripting. This has to do with the technique of just building up the table's rows using concatenation and appending it as HTML. While not as smooth, something like this may work to build that table and encode the name.

var tr = $('<tr>');
$('<td><input disabled="true" type="checkbox" ' + checked + '></td>').appendTo(tr);
var td = $('<td>');
td.text(item.name);
td.appendTo(tr);
$('<td><button onclick="editItem(' + item.id + ')">Edit</button></td>' +
'<td><button onclick="deleteItem(' + item.id + ')">Delete</button></td>').appendTo(tr);
tr.appendTo($('#todos'));

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 583ae3e7-5915-f22b-e54c-6c100cf2a7da
• Version Independent ID: 95f2549e-29f9-e31a-b4d0-432b971643ff
• Content: Create a Web API with ASP.NET Core and Visual Studio
• Content Source: aspnetcore/tutorials/first-web-api.md
• Product: aspnet-core
• GitHub Login: @Rick-Anderson
• Microsoft Alias: riande

[Rick-Anderson]

@jamesjardine thanks.

[Rick-Anderson]

@scottaddie please review. Should I bump this up to @blowdart ?

[Rick-Anderson]

@MikeWasson FYI.

[scottaddie]

@Rick-Anderson Let's have Barry weigh in on this.

[Rick-Anderson]

@blowdart customer discovered vulnerable to cross-site scripting. Please comment and set priority.

[blowdart]

Oh dear. Yes, you could probably optimise a bit more;

        var $tr = $('<tr>').append(
            $('<td>').text(...),
            $('<td>').text(item.name),
            $('<td>').text(...)

[Rick-Anderson]

@fiyazbinhasan can you fix this JavaScript?

[fiyazbinhasan]

@Rick-Anderson sure! @blowdart already provided the solution. I'll fix the getdata() method by tomorrow.

[fiyazbinhasan]

@Rick-Anderson @blowdart @jamesjardine please check https://github.com/aspnet/Docs/pull/9415

[scottaddie]

Fixed in https://github.com/aspnet/Docs/pull/9415.