One can insert content in the content of a calendar event which will be executed as JavaScript.
Steps to reproduce
- Access http://alloyui.com/examples/scheduler/real-world/
- Click on the grid to create an event, as in the picture below:
- As the title of the event, insert
"><img src="xx" onerror="alert('xss')" /><"
with the quotes.
- Click in "Save"
Expected results
- No alert dialog will pop up.
- The title of the event will be presented as below:
Actual results
- An alert dialog appears as below, and the event title is presented as "> <"