Forums

Heads up everyone, if you use widgets such as autocomplete or datatable, you may be vulnerable to a stored XSS attack if you aren't specifying explicit formatters for textual data. The default formatters YUI supplies render textual data as HTML markup. In particular, if the textual data contains tags (such as script tags), those tags will be added to the page as live HTML. That may not be what you want.

Datatable supplies a formatter (formatText) which renders strings as text, escaping HTML brackets and ampersands. For autocomplete, you are going to have to copy the formatText implementation and override your autocomlete instance's formatResult method with it. As far as I know, autocomplete doesn't supply a proper formatter for textual data, nor is there a general YUI function which takes strings and outputs HTML text with entities.

Thanks for calling out these problems. If you haven't already, would you mind filing bugs for these and any other potential XSS vectors you find? That'll be the most reliable way to ensure they get in front of a developer immediately and that they're prioritized and fixed for the next release.