XSS hole in Grid

[Bryan Forbes]

Right now, the grid just inserts whatever it gets from its "get" function into the node. We need to keep javascript from running in what comes from the "get" function.

[Bryan Forbes]

(In [17359]) * Fixes XSS hole in Grid (refs #9173 !strict).

[Bryan Forbes]

(In [17360]) * Fixed XSS hole in Grid (fixes #9173 !strict).

[Mignon Belongie]

This breaks dojox/grid/tests/test_change_structure.html. Is there a better way to put buttons in a grid?

[jfirebau]

This "feature" needs to be something that can be turned on/off. There are very legitimate scenarios where a developer would want the HTML and JAVASCRIPT code to be run without adding a formatter. In fact, this solution adds a tremendous amount of processing time to the rendering of each cell if you want to have HTML shown in a cell.

Now we are requiring a developer to perform a string replace on the data to convert all '<' symbols back -- not to mention the Grid code had a string replace to convert them to HTML entities prior to the formatter. That's a double hit to rendering performance on each cell render.

[Nathan Toone]

This has been fixed.