HTML injection vulnerability

[theodorejb]

I was very surprised to discover that ag-Grid does nothing to escape field values by default.

With a column definition like: {headerName: "Name", field: "name"} a user can enter a name such as <span onclick="alert('hacked!')">John Smith</span> and effectively initiate a cross-site scripting attack.

The only time field values should not be escaped is if there is a a custom cellRenderer for the column.

Related: #9 (comment)

[AmitMY]

+1

[theodorejb]

Per Mozilla's documentation, node.textContent should be used instead of Element.innerHTML when inserting plain text.

[ceolter]

ok so i've changed from:

this.eParentOfValue.innerHTML = valueToRender.toString();

to

this.eParentOfValue.textContent = valueToRender.toString();

is that all i need to do??

i'm afraid it will have an impact against some older browsers - and advice on that?

[theodorejb]

@ceolter Yes, that should be all you have to do.

i'm afraid it will have an impact against some older browsers

Only if you're trying to support IE8, which I don't think is the case based on #40.

Thanks!

[AmitMY]

I am not sure of the context of the code, so it may already be done.
If possible, only do this for 'field' columns. Columns that use cellRenderer may return buttons, or icons. (Example is fontawesome icons)

Don't know what about valueGetter...

[ceolter]

it's only done when no cellRenderer is used.

[theodorejb]

@AmitMY valueGetter values should be plain text (and thus inserted via textContent) since they are used for searching, filtering, and sorting.

[ceolter]

valueGetter isn't used for rendering - the value is then either passed to cellRenderer or rendered by grid (which, as above, uses textContext now)

[kylecannon]

This is now back as a regression from the new rendering engine. @ceolter

[SebDez]

I fixed this in my project by setting a default cellRenderer for my grid :

defaultColDef: {
          cellRenderer: function (params) {
            var eDiv = document.createElement('div');
            eDiv.textContent = params.value;
            return eDiv;
          }
        }