Possible XSS vulnerability

[jdbruijn]

We might have found a XSS injection vulnerability in Servoy.
Run attached sample and paste the following line in the edit field:

XSSStored<script>alert(1)</script>

This script will run as soon as you leave the edit field.

Are we as developers responsible to make sure this kind of input is not allowed, or is this something that Servoy should/can fix?

[Andrei Costescu]

Can you create a feature request for this?
We could make it easier for the developers to avoid this by disallowing by default such script execution on some default components (like labels). Of course it should be possible to allow it as well if developers want that.

Until then you need to validate this kind of data.

[jdbruijn]

Done: https://support.servoy.com/browse/SVY-10144