kendo templates XSS

testing the default encoding done in kendo templates

by Trevor Power

HTML

<script src="http://kendo.cdn.telerik.com/2018.3.1017/js/kendo.all.min.js"></script>
<link rel="stylesheet" href="http://kendo.cdn.telerik.com/2018.3.1017/styles/kendo.common.min.css">
<div id="grid">

</div>

CSS

body {
  margin: 20px;
}

.xss {
  background: red;
}

JavaScript

function xss(node) {
  node.parentElement.classList.add('xss');
}

$('#grid').kendoGrid({
  dataSource: {
    data: [{
      name: "&lt;script&gt;"
    }, {
      name: "\" onclick=\"xss(this)\""
    }, {
      name: ""
    }]
  },
  columns: [{
      title: 'Raw Content',
      template: kendo.template('#= name #')
    },
    {
      title: 'Content Encoded',
      template: kendo.template('#: name #')
    },
    {
      title: 'Title Encoded',
      template: kendo.template('<span title="#: name #">n/a</span>')
    },
    {
      title: 'Title Raw',
      template: kendo.template('<span title="#= name #">n/a</span>')
    }
  ]
});

console.log(kendo.htmlEncode.toSource())