Scheduler component is susceptible to XSS attack

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 2.0.x
• Fix Version/s: None
• Component/s: None
• Labels:
  • security
  • xss

One can insert content in the content of a calendar event which will be executed as JavaScript.

Steps to reproduce

1. Access http://alloyui.com/examples/scheduler/real-world/
2. Click on the grid to create an event, as in the picture below:
   
3. As the title of the event, insert

   "><img src="xx" onerror="alert('xss')" /><"

   with the quotes.

4. Click in "Save"

Expected results

1. No alert dialog will pop up.
2. The title of the event will be presented as below:
   

Actual results

1. An alert dialog appears as below, and the event title is presented as "> <"