Best way to handle XSS vulnerabilities in custom visuals

mjbellomo — Tue, 21 Mar 2017 02:24:26 GMT

Hey all,

I'll jump in here and ask something I've been stuck on for a while.

I've been working on this custom visual to display html formatted paragraphs so that I can pass formatting inline with value data into a custom visual for long text, which is useful for text fields.

The gitHub Repo is here:

https://github.com/mjbellomo/pbvizHtmlVisual

For simplicity's sake I'd like to be able to be able to set the innerHTML = dataView.Table.Rows.ToString() but I'm concious of the vulnerabilites intruduced by doing so, short of adding in all of the various format options into the format panel individually.

Thoughts?

Re: Best way to handle XSS vulnerabilities in custom visuals

v-viig — Fri, 14 Apr 2017 11:21:54 GMT

Hello mjbellomo,

Thanks for your feedback.

I think that you can use js-xss to prevent a XSS injection.

Ignat Vilesov,

Software Engineer

Microsoft Power BI Custom Visuals

pbicvsupport@microsoft.com

topic Re: Best way to handle XSS vulnerabilities in custom visuals in Custom Visuals Development Discussion

Best way to handle XSS vulnerabilities in custom visuals

Re: Best way to handle XSS vulnerabilities in custom visuals