How To prevent attacks such as cross-site scripting or link Injection on Report Comments.

[rsharma]

Hi,

We have BI Reports with comment feature where user can post any comments, in the security check we noticed that there is no validation on user comments to prevent data validation attack such as cross-site scripting or link Injection. Is there any or centralized validation module to prevent such contents post.

Regards,

Ravi

[LizOsbourn]

Hello - I am concerned about same - how does MS prevent cross site scripting threats in the PBI web browser  ? 

Is the browser code ( javascript/html ) is output encoded so that any bad data masking as code that may possibly be retrieved from a data source would not be able to impact the PBI gateway browser ?

[Anonymous]

Hi Ravi,

I don't see the issue here. How can you create an XSS in the comments?