jQuery Grid Plugin - jqGrid

I tried the autoencode option, and it works as designed.  However, there's a problem with this scheme.  Sending the code to the database works fine, and no alert is displayed if I press [ENTER].  Let's assume that the encoded data is stored in the database, or equivalently, when Windows Forms applications also access the data, the data is decoded for the database and then reencoded upon retrieval.  Either way, the data needs to be displayed is returned in JSON format with HTML entities encoded when the grid is refreshed.

However, after the refresh, it's still possible for an alert dialog to occur.  You can reproduce this by clicking in any of the cells where the <script> values are displayed and clicking on another row, which calls restoreRow() with the example code.  When the HTML entities are sent encoded in JSON format as &lt; and &gt;, they display as < and > in the grid, which is what we want, but then cancelling the edit executes the script instead of saving it.  Autoencode only seems to prevent attacks when saving the data, not when cancelling an inline edit.  When the original data is restored to the cell, it seems to be appended to the document unescaped, so that a cell with the input value “<script>alert('hi');</script>” will then show a null string after the edit is cancelled using restoreRow.  Therefore, a hacker can still put these script tags into the database, and even though users won't be attacked when saving data, they'll still be attacked when cancelling editing on rows that contain the script tags.

One way to get around this problem is to double-escape strings.  But then, additional characters keep getting appended onto anything that originally had a “<” character in it, and it's a problem for applications where math (i.e. x < 3) is stored in the text.  You'll get things like “x &lt; 3″ or even “x &lt;&lt; 3.”  Or you can strip all tags like that, but then you can never have “<” and “>” characters anywhere.

I just discovered what may be another oversight.

Try adding a default search box below a grid, using the grid's column models.  This also works with a separate model for search.  Enter "<script>alert('hi');</script>" in the search field for one column, and then press [ENTER].

The data is sent unencoded to the server.  Ideally, if autoencode = true, I would think that it would be best to call whatever the Javascript equivalent is to Server.URLEncode() before passing data.  In my case, I received a 403 ("Forbidden") error when attempting to search on fields using "<" or ">" characters, because apparently the webserver is configured to reject URLs that include these characters in order to prevent XSS attacks.  Therefore, not only might developers get confused and store this data unintentionally, but some servers are also configured beyond the developer's control to reject such queries.