Forum Discussion

rsharma's avatar
rsharma
New Member
7 years ago

How To prevent attacks such as cross-site scripting or link Injection on Report Comments.

Hi,

 

We have BI Reports with comment feature where user can post any comments, in the security check we noticed that there is no validation on user comments to prevent data validation attack such as cross-site scripting or link Injection. Is there any or centralized validation module to prevent such contents post.

 

Regards,

Ravi

General Comment

2 Replies

  • Anonymous's avatar
    Anonymous
    Not applicable
    6 years ago

    Hi Ravi,

     

    I don't see the issue here. How can you create an XSS in the comments?

  • Anonymous's avatar
    Anonymous
    Not applicable
    6 years ago

    Hello - I am concerned about same - how does MS prevent cross site scripting threats in the PBI web browser  ? 

    Is the browser code ( javascript/html ) is output encoded so that any bad data masking as code that may possibly be retrieved from a data source would not be able to impact the PBI gateway browser ?