Hi,
when using the StripCssExpressions Content Filter, it's working as expected in most cases, but when there's a linebreak inside of the style it breaks.
For example, the content filters used in a RadEditor control would be:<telerik:RadEditor ContentFilters="RemoveScripts,StripCssExpressions,StripDomEventAttributes" />
This works for (expression gets filtered out as expected)
<span style="width: expression((document.body.offsetWidth / 4 + 30) + 'px'); background-color: green;">text in a span</span>This doesn't work for (expression remains)
<span style="width:
expression((document.body.offsetWidth / 4 + 30) + 'px'); background-color: green;">text in a span</span>
The usage for the content filter is to prevent XSS attacks, and in our solution used besides several other means to avoid malicious code execution.
As expected, the filter not working is a security risk.
Does anyone have a good workaround available? (or is there a timeline on an official bugfix?)
When it comes to security issues, you have to work a bit more outside of the box. I can happily inject css expressions into the demo and it doesn't strip them.
The easiest way to do this without intercepting the request (using fiddler or other similar tools), is by using the devtools of your browser, and editing the raw html in the element (as seen in the screenshot below).
On the controls I'm using I've also added a decent amount of serverside filtering to prevent code injection, but this one slipped through the cracks since initial testing (without linebreaks) showed promising results.
