Skip to content

Commit 3d41819

Browse files
author
Kendo Bot
committed
Sync with Kendo UI Professional
1 parent 72bfa68 commit 3d41819

File tree

6 files changed

+405
-8
lines changed

6 files changed

+405
-8
lines changed

‎docs-aspnet/getting-started-core/helper-basics/security-and-validation.md‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
---
2+
title: Security and Validation
3+
page_title: Security and Validation
4+
description: "Get started with Telerik UI for ASP.NET Core and learn the fundamentals for XSS and CSRF attacks."
5+
slug: aspnetcore_security_gettingstarted
6+
position: 4
7+
permalink: /getting-started/helper-basics/security-and-validation
8+
---
9+
10+
# Security and Validation
11+
12+
Preventing Cross-site scripting (XSS) and implementing validation for Cross-Site Request Forgery(CSRF) tokens can significantly boost the security of the application and prevent malicious script execution.
13+
14+
## Cross-Site Scritping
15+
16+
### XSS Attacks
17+
18+
Cross-site scripting attacks are a type of injection that aims to, in the majority of cases, cause harm to the application, gather personal information and executing malicious scripts. The attackers can use the XSS to bypass access controls such as the same-origin policy.
19+
20+
### XSS Protection
21+
22+
Escaping any unsafe HTML tags should be mainly executed on the server-side. The client-side escaping can be easily bypassed if the attacker intercepts the to-be sent request and manually replaces the escaped tags. The server would receive the unescaped and unsafe HTML tags. This requires for a server-side validation and escaping for any potentially harmful tags. As a rule of thumb, unsafe HTML should never be saved in the database.
23+
24+
> The server-side implementation for escaping the unsafe HTML tags has to be handled by the developer according to their go-to practices and preferences.
25+
26+
## XSS handling in {{ site.product }}
27+
28+
Several {{ site.product }} widgets allow the user to input HTML or can display non-encoded HTML and can be a potential source of Cross-site scripting attacks if not handled by the developer.
29+
30+
### Editor
31+
32+
The Editor provides configuration options that help the developer prevent XSS attacks. By default, the Editor does not allow the execution of scripts inside its content area and also provides configuration options that allow the developer to implement custom sanitizing functionality. Read more on the XSS protection for the Editor in the [Preventing Cross-Site Scripting article](https://docs.telerik.com/kendo-ui/controls/editors/editor/preventing-xss).
33+
34+
### Grid
35+
36+
The Columns [`.Encoded()`](/api/Kendo.Mvc.UI.Fluent/GridBoundColumnBuilder#encodedsystemboolean) configuration option of the Grid provides the possibility to display non-encoded HTML value if set to `false`. In such scenarios it is important to sanitize the values on the server to ensure only safe HTML is rendered.
37+
38+
### Spreadsheet
39+
40+
When the [`Html()`](/api/Kendo.Mvc.UI.Fluent/SpreadsheetSheetRowCellBuilder#htmlsystemboolean) configuration option is set to `true` or the client-side [`html` method](https://docs.telerik.com/kendo-ui/api/javascript/spreadsheet/range/methods/html) is used the user is allowed to input HTML. In such scenarios it is important to sanitize cell values on the server to ensure only safe html is passed.
41+
42+
### PanelBar
43+
44+
The PanelBar [`Items`](/api/Kendo.Mvc.UI.Fluent/PanelBarBuilder#itemssystemactionkendomvcuifluentpanelbaritemfactory) configuration option allows the developer to disable the encoding for a particular item.
45+
46+
```
47+
@(Html.Kendo().PanelBar()
48+
.Name("PanelBar")
49+
.Items(items =>
50+
{
51+
items.Add().Text("<b>First Item</b>").Encoded(false);
52+
items.Add().Text("Second Item");
53+
})
54+
)
55+
```
56+
57+
In such scenarios the use of HTML for the item text is allowed. The developer should sanitize any values on the server to ensure only safe html is passed.
58+
59+
### Menu
60+
61+
The Menu [`Items`](/api/Kendo.Mvc.UI.Fluent/MenuBuilder#itemssystemactionkendomvcuifluentmenuitemfactory) configuration option allows the developer to disable the encoding for a menu item.
62+
63+
```
64+
@(Html.Kendo().Menu()
65+
.Name("Menu")
66+
.ItemAction(item =>
67+
{
68+
item.Text("<b>Menu item 1</b>").Encoded(false);
69+
item.Text(Menu item 2);
70+
})
71+
)
72+
```
73+
74+
In such scenarios the use of HTML for the Menu item text is allowed. The developer should sanitize any values on the server to ensure only safe html is passed.
75+
76+
### Kendo Templates
77+
78+
The usage of [Kendo Templates allows the developer to decide whether the displayed HTML will be encoded or not](https://docs.telerik.com/kendo-ui/framework/templates/overview#rendering-html-encoded-values). When using Kendo Templates and working with data from unknown sources, it is advisable to use HTML encoding in case users have included malicious HTML markup in the content.
79+
80+
### DataSourceRequest
81+
82+
The [`DataSourceRequest`](https://docs.telerik.com/aspnet-mvc/api/Kendo.Mvc.UI/DataSourceRequest) object contains information on how the data, requested by a the Kendo widget, should be paged, filtered, sorted, grouped. This information is further translated internally to System.Linq.Expressions.Expression class. In the end, the ToDataSourceResult executes a LINQ query based on the information contained DataSourceRequest object, passed to an action method. The DataSourceRequest object itself does not contain user-provided data and does not contain HTML.
83+
84+
```
85+
//
86+
// Summary:
87+
// Provides information about paging, sorting, filtering and grouping of data.
88+
public class DataSourceRequest
89+
{
90+
public DataSourceRequest()
91+
{
92+
Page = 1;
93+
Aggregates = new List<AggregateDescriptor>();
94+
};
95+
96+
//
97+
// Summary:
98+
// The current page.
99+
public int Page { get; set; }
100+
//
101+
// Summary:
102+
// The page size.
103+
public int PageSize { get; set; }
104+
//
105+
// Summary:
106+
// The sorting of the data.
107+
public IList<SortDescriptor> Sorts { get; set; }
108+
//
109+
// Summary:
110+
// The filtering of the data.
111+
public IList<IFilterDescriptor> Filters { get; set; }
112+
//
113+
// Summary:
114+
// The grouping of the data.
115+
public IList<GroupDescriptor> Groups { get; set; }
116+
//
117+
// Summary:
118+
// The data aggregation.
119+
public IList<AggregateDescriptor> Aggregates { get; set; }
120+
//
121+
// Summary:
122+
// Indicates whether group paging is enabled.
123+
public bool GroupPaging { get; set; }
124+
//
125+
// Summary:
126+
// Indicates whether subgroup count should be included
127+
public bool IncludeSubGroupCount { get; set; }
128+
//
129+
// Summary:
130+
/// The current skip.
131+
public int Skip { get; set; }
132+
//
133+
// Summary:
134+
// The current take.
135+
public int Take { get; set; }
136+
}
137+
```
138+
139+
## Cross-Site Request Forgery
140+
141+
The Cross-Site Request Forgery is generally initiated by a malicious script and not the authenticated user. Submitting a request or a form on the behalf of the authenticated user can potentially expose the application at risk, accessing internal information and exercising harmful operations on the application.
142+
143+
The anti-forgery tokens are used to ensure that a form or a request has been submitted by the user and not by a malicious script. The also called request validation tokens are hidden inputs that have a randomly generated value that cannot be read by a script.
144+
145+
### Implement CSFR token validation
146+
147+
1. Include the CSFR token on the page:
148+
```
149+
Html.AntiForgeryToken()
150+
```
151+
152+
1. Send the token to the server-side by using the transport.data option of the DataSource. The [`kendo.antiforgerytokens`](https://docs.telerik.com/kendo-ui/api/javascript/kendo/methods/antiforgerytokens) method returns an object that contains common CSRF tokens that are found on the page.
153+
154+
155+
```
156+
.Read(read=>read.Action("DetailProducts_Read", "Grid").Data("sendForgery"))
157+
158+
// . . .
159+
160+
<script>
161+
function sendForgery() {
162+
return kendo.antiForgeryTokens();
163+
}
164+
</script>
165+
166+
```
167+
168+
1. Validate the token by decorating the ActionMethods with the `[ValidateAntiForgeryToken]` data annotation:
169+
170+
```
171+
[ValidateAntiForgeryToken]
172+
public ActionResult ActionMethodName( ModelName model )
173+
{
174+
}
175+
176+
```

‎docs-aspnet/getting-started-mvc/helper-basics/security-and-validation.md‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
---
2+
title: Security and Validation
3+
page_title: Security and Validation
4+
description: "Get started with Telerik UI for ASP.NET MVC and learn the fundamentals for XSS and CSRF attacks."
5+
slug: aspnetmvc_security_gettingstarted
6+
position: 5
7+
permalink: /getting-started/helper-basics/security-and-validation
8+
---
9+
10+
# Security and Validation
11+
12+
Preventing Cross-site scripting (XSS) and implementing validation for Cross-Site Request Forgery(CSRF) tokens can significantly boost the security of the application and prevent malicious script execution.
13+
14+
## Cross-Site Scritping
15+
16+
### XSS Attacks
17+
18+
Cross-site scripting attacks are a type of injection that aims to, in the majority of cases, cause harm to the application, gather personal information and executing malicious scripts. The attackers can use the XSS to bypass access controls such as the same-origin policy.
19+
20+
### XSS Protection
21+
22+
Escaping any unsafe HTML tags should be mainly executed on the server-side. The client-side escaping can be easily bypassed if the attacker intercepts the to-be sent request and manually replaces the escaped tags. The server would receive the unescaped and unsafe HTML tags. This requires for a server-side validation and escaping for any potentially harmful tags. As a rule of thumb, unsafe HTML should never be saved in the database.
23+
24+
> The server-side implementation for escaping the unsafe HTML tags has to be handled by the developer according to their go-to practices and preferences.
25+
26+
## XSS handling in {{ site.product }}
27+
28+
Several {{ site.product }} widgets allow the user to input HTML or can display non-encoded HTML and can be a potential source of Cross-site scripting attacks if not handled by the developer.
29+
30+
### Editor
31+
32+
The Editor provides configuration options that help the developer prevent XSS attacks. By default, the Editor does not allow the execution of scripts inside its content area and also provides configuration options that allow the developer to implement custom sanitizing functionality. Read more on the XSS protection for the Editor in the [Preventing Cross-Site Scripting article](https://docs.telerik.com/kendo-ui/controls/editors/editor/preventing-xss).
33+
34+
### Grid
35+
36+
The Columns [`.Encoded()`](/api/Kendo.Mvc.UI.Fluent/GridBoundColumnBuilder#encodedsystemboolean) configuration option of the Grid provides the possibility to display non-encoded HTML value if set to `false`. In such scenarios it is important to sanitize the values on the server to ensure only safe HTML is rendered.
37+
38+
### Spreadsheet
39+
40+
When the [`Html()`](/api/Kendo.Mvc.UI.Fluent/SpreadsheetSheetRowCellBuilder#htmlsystemboolean) configuration option is set to `true` or the client-side [`html` method](https://docs.telerik.com/kendo-ui/api/javascript/spreadsheet/range/methods/html) is used the user is allowed to input HTML. In such scenarios it is important to sanitize cell values on the server to ensure only safe html is passed.
41+
42+
### PanelBar
43+
44+
The PanelBar [`Items`](/api/Kendo.Mvc.UI.Fluent/PanelBarBuilder#itemssystemactionkendomvcuifluentpanelbaritemfactory) configuration option allows the developer to disable the encoding for a particular item.
45+
46+
```
47+
@(Html.Kendo().PanelBar()
48+
.Name("PanelBar")
49+
.Items(items =>
50+
{
51+
items.Add().Text("<b>First Item</b>").Encoded(false);
52+
items.Add().Text("Second Item");
53+
})
54+
)
55+
```
56+
57+
In such scenarios the use of HTML for the item text is allowed. The developer should sanitize any values on the server to ensure only safe html is passed.
58+
59+
### Menu
60+
61+
The Menu [`Items`](/api/Kendo.Mvc.UI.Fluent/MenuBuilder#itemssystemactionkendomvcuifluentmenuitemfactory) configuration option allows the developer to disable the encoding for a menu item.
62+
63+
```
64+
@(Html.Kendo().Menu()
65+
.Name("Menu")
66+
.ItemAction(item =>
67+
{
68+
item.Text("<b>Menu item 1</b>").Encoded(false);
69+
item.Text(Menu item 2);
70+
})
71+
)
72+
```
73+
74+
In such scenarios the use of HTML for the Menu item text is allowed. The developer should sanitize any values on the server to ensure only safe html is passed.
75+
76+
### Kendo Templates
77+
78+
The usage of [Kendo Templates allows the developer to decide whether the displayed HTML will be encoded or not](https://docs.telerik.com/kendo-ui/framework/templates/overview#rendering-html-encoded-values). When using Kendo Templates and working with data from unknown sources, it is advisable to use HTML encoding in case users have included malicious HTML markup in the content.
79+
80+
### DataSourceRequest
81+
82+
The [`DataSourceRequest`](https://docs.telerik.com/aspnet-mvc/api/Kendo.Mvc.UI/DataSourceRequest) object contains information on how the data, requested by a the Kendo widget, should be paged, filtered, sorted, grouped. This information is further translated internally to System.Linq.Expressions.Expression class. In the end, the ToDataSourceResult executes a LINQ query based on the information contained DataSourceRequest object, passed to an action method. The DataSourceRequest object itself does not contain user-provided data and does not contain HTML.
83+
84+
```
85+
//
86+
// Summary:
87+
// Provides information about paging, sorting, filtering and grouping of data.
88+
public class DataSourceRequest
89+
{
90+
public DataSourceRequest()
91+
{
92+
Page = 1;
93+
Aggregates = new List<AggregateDescriptor>();
94+
};
95+
96+
//
97+
// Summary:
98+
// The current page.
99+
public int Page { get; set; }
100+
//
101+
// Summary:
102+
// The page size.
103+
public int PageSize { get; set; }
104+
//
105+
// Summary:
106+
// The sorting of the data.
107+
public IList<SortDescriptor> Sorts { get; set; }
108+
//
109+
// Summary:
110+
// The filtering of the data.
111+
public IList<IFilterDescriptor> Filters { get; set; }
112+
//
113+
// Summary:
114+
// The grouping of the data.
115+
public IList<GroupDescriptor> Groups { get; set; }
116+
//
117+
// Summary:
118+
// The data aggregation.
119+
public IList<AggregateDescriptor> Aggregates { get; set; }
120+
//
121+
// Summary:
122+
// Indicates whether group paging is enabled.
123+
public bool GroupPaging { get; set; }
124+
//
125+
// Summary:
126+
// Indicates whether subgroup count should be included
127+
public bool IncludeSubGroupCount { get; set; }
128+
//
129+
// Summary:
130+
/// The current skip.
131+
public int Skip { get; set; }
132+
//
133+
// Summary:
134+
// The current take.
135+
public int Take { get; set; }
136+
}
137+
```
138+
139+
## Cross-Site Request Forgery
140+
141+
The Cross-Site Request Forgery is generally initiated by a malicious script and not the authenticated user. Submitting a request or a form on the behalf of the authenticated user can potentially expose the application at risk, accessing internal information and exercising harmful operations on the application.
142+
143+
The anti-forgery tokens are used to ensure that a form or a request has been submitted by the user and not by a malicious script. The also called request validation tokens are hidden inputs that have a randomly generated value that cannot be read by a script.
144+
145+
### Implement CSFR token validation
146+
147+
1. Include the CSFR token on the page:
148+
```
149+
Html.AntiForgeryToken()
150+
```
151+
152+
1. Send the token to the server-side by using the transport.data option of the DataSource. The [`kendo.antiforgerytokens`](https://docs.telerik.com/kendo-ui/api/javascript/kendo/methods/antiforgerytokens) method returns an object that contains common CSRF tokens that are found on the page.
153+
154+
155+
```
156+
.Read(read=>read.Action("DetailProducts_Read", "Grid").Data("sendForgery"))
157+
158+
// . . .
159+
160+
<script>
161+
function sendForgery() {
162+
return kendo.antiForgeryTokens();
163+
}
164+
</script>
165+
166+
```
167+
168+
1. Validate the token by decorating the ActionMethods with the `[ValidateAntiForgeryToken]` data annotation:
169+
170+
```
171+
[ValidateAntiForgeryToken]
172+
public ActionResult ActionMethodName( ModelName model )
173+
{
174+
}
175+
176+
```

‎docs-aspnet/html-helpers/data-management/filemanager/context-menu.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ position: 3
1010
# ContextMenu in FileManager
1111
The {{ site.product }} FileManager's ContextMenu enables you to easily execute FileManager commands on the selected file or folder.
1212

13-
The component uses the {{ site.product }} ContextMenu, enabling you to get full advantage of its [Client API](/api/javascript/ui/filemanager). Once an item is selected, the corresponding command is executed.
13+
The component uses the {{ site.product }} ContextMenu, enabling you to get full advantage of its [Client API](https://docs.telerik.com/kendo-ui/api/javascript/ui/filemanager). Once an item is selected, the corresponding command is executed.
1414

1515
The default items in the ContextMenu are `rename` and `delete`. You can define your custom items which can execute custom commands. You can also manage what items should be visible, by enumerating the needed ones in the initialization of the component (see Example below)
1616

0 commit comments

Comments
 (0)