on jqx-combo-box Search with multiSelect enabled

[JanyParticipant]

Hi,

We are using jqx-combo-box with multiselect option enabled. In the search field if we give script its executing that. I tried <script>alert(1)</script> as search text, it is immediately showing the alert message with 1. The same issue happening with the demo example also by enabling multiselect. This does not happen when multiselect mode is false. This looks to be a security issue. Have you faced this issue? If so, what is the plan to fix this?

Thanks
Jany

[HristoParticipant]

Hello Jany,

Thank you for this feedback.

Best Regards,
Hristo Hristov

jQWidgets team
http://www.jqwidgets.com

[JanyParticipant]

Hi Hristo Hristov,

Please let us know what is the plan to address this? Do you have any open defect for this? We use jqwidgets in our product and our customers raised this as severe security issue.

Thanks
Jany

[JanyParticipant]

Hi Team,

Any update on this defect? We are waiting for your comments to get back to our customer.

Thanks
Jany

[Peter StoevKeymaster]

Hi Jany,

We do not think that this is a defect. The ComboBox displays an Input field and we do not restrict it at all.

Best Regards,
Peter Stoev

jQWidgets Team
http://www.jqwidgets.com

[JanyParticipant]

Hi Peter Stoev,

I agree with you on not restricting on the input field used for search.

But the text entered for search should be treated as text, and it should not be executed as script. Currently when we enter some scripts as search input, it is not treating it as simple search text, instead executing the entered text.

Thanks
Jany

[JanyParticipant]

Hi Peter Stoev,

Any update on this.

Thanks
Jany

[JanyParticipant]

Hi Team,

Any update on this?

Not restricting characters on the input field used for search is OK, but the text entered for search should be treated as text, and it should not be executed as script. Currently when we enter some scripts as search input, it is not treating it as simple search text, instead executing the entered text. This happens only when multiselect mode is true in jqx-combo-box

Thanks
Jany

[Author]

Posts