What are the legitimate risks of using MarkupString to render html inside of a Blazor page?
There is a warning mentioned on this Blazor 0.5.0 preview blog post.
However I’ve also seen some other Stackoverflow posts of users trying to execute JavaScript/C# inside of a MarkupString (fragment/object?) and explanations that it isn’t possible.
For example.
How can I render html that contains script tag in Blazor
And…
Blazor: How to use a onclick event in MarkupString
I’ve not been able to find good documentation on MarkupString to determine if it is benign or not.
In my use case, some developers could potentially edit the html snippets being rendered outside of a release process, so risk is pretty minimal anyway.
Thanks!
I am not a security expert but i can think of an easy example.
The Warning you mention is about Markup from untrused sources.
For example someone could redirect the user to his phishing site.
@page "/"
<PageTitle>Home</PageTitle>
<h1>Dynamic HTML Content Example</h1>
<div>@HtmlContent</div>
@code {
private MarkupString HtmlContent;
protected override void OnInitialized()
{
var html = "<p style='color: blue;'>a <a href='https://www.google.com' target='_blank'>link some site</a>.</p>";
HtmlContent = new MarkupString(html);
}
}
I am not sure if Cross-Site Scripting attacks are possible.
Not to mention that someone could destroy your site Layout.
You can run JavaScript.
Sample:
@((MarkupString)html)
@code{
string html = @"<button type='button' onclick='alert(""boo"")'>Free Money</button> ";
}
So the risk comes from ‘untrusted sources’, ie user input.