Bugs in HTML Sanitization

[Ivan5757]

The AJAX Control Toolkit \19.1.0\

The installation method

• NuGet package

Minimal steps to reproduce the bug

Go to demo page
Type "Hello world!<script>alert();</script>"
Submit content

Actual result

"Hello worldalert()"
Script tags and semicolon are removed as well as the exclamation point.
If you try submitting "Hello world! <script>alert();</script>", the space before <script> is removed. It's truncating whatever character precedes <script>.

Expected result

No truncating. Also, should the semicolon be removed as part of the sanitization process?

###Addition questions/issues
***With EnableSanitization set to false when tested in local project
***Using user controls (ascx)

I am experiencing overall weird behavior when displaying/rendering text using the extender on a textbox. For example, when the page first loads, my textbox should display <script>alert();</script> (underlined as well). Instead, it is blank. When I reload the page thru an Update button, it displays "<script>alert();</script>" instead of the rich text format. In my database, the value is stored as "<script><b><i><u>alert();</u></i></b></script>". What am I doing wrong? Do I have something configured incorrectly? Thanks in advance for the help.

Browser(s) used

Chrome

A site deployment method

• VS development web-server,
• IIS

[AlekseyMartynov]

Script tags and semicolon are removed as well as the exclamation point.

I cannot confirm this. Here is the request/response trace from https://ajaxcontroltoolkit.devexpress.com/HtmlEditorExtender/HtmlEditorExtender.aspx:

---

As for your additional questions, I acknowledge the behavior you're describing.

txtBox1.Text = "&lt;script&gt;<b><i><u>alert();</u></i></b>&lt;/script&gt;"

The Decode function corrupts the text.

I cannot suggest any immediate workaround. Consider a different HTML editor component for your project: Quill, CKEditor, etc.

[Ivan5757]

I swear to you it was doing it yesterday. I tried it on the demo before I made the post in order to double check it wasn't just locally. I cannot get it to repeat on the demo now either (I wish I had captured it). Here is the sequence on my local (request/response):

Typing (three spaces between 2020 and <script>) "Test Title 2-10-2020 <script>alert();</script>":

Result (the script tags and one space are removed):

Another run with <script>next to 2020:

Result (the script tags and the ending 0 on 2020 are removed):

[Ivan5757]

An update. I had an old tab open, and I did reload to record the request/response. This is what I got:

It removed the space with the tags.

The only difference I noticed between the new vs old tab was that these errors popped up in the new one: