print extension has a XSS vulnerability.

jsn

I'm adding rows with HTML like so: datatable.row.add('HTML ROW HERE') and when I hit the print button, if the value of a column is something like: alert('hi'), it executes.

allan

DataTables will render the HTML directly so this is to some degree expected. If you want to protect against this you would need to use a renderer as discussed in the security manual.

I plan to offer an option in future versions of DataTables whereby the output will be text rather than HTML, but I know a lot of people rely on outputting HTML, hence way the rendering options are available.

Allan

jsn

Thanks for your response,

I'm using a templating engine to render the html initially, so the values are properly escape. My problem only occurs when I hit the "print" button

allan

If you've bypassed the DataTables rendering function you would probably need to do some kind of rendering for the print button as well. Its difficult to say without a test case showing the issue what the actual fix would be though.

Allan