It's possible for user to put some random values into restri

Topic: It's possible for user to put some random values into restricted Date and Select

pavelpossiblep asked 4 years ago

Expected behavior

When "data-mdb-toggle="datepicker"" is set on date field and user clicks it the datepicker shows up. This is relatively convenient to use to restrict user from putting in wrong kinds of data (e.g. letters instead of digits etc.) It seems to be obvious that in this case most attempts to put wrong data in should be blocked.

Actual behavior

However, if you click and hold, you will bee able to type in the field freely. Also you can paste anything to this field from clipboard using the same exploit.

Similar problem appears for Selects. If you put "data-mdb-validation="true"" on your the caret appears when you click on it. This allows you to paste any data to the field without changing the selected option value which leads the user to submitting incorrect data.

Here's a snippet I made. It also has the description of problemshttps://mdbootstrap.com/snippets/standard/pavelpossiblep/3153162

UNNdev pro premium priority commented 4 years ago

You can not only paste in the Select, but using the context menu also insert emojis or delete text. :(

Add comment

Grzegorz Bujański staff answered 4 years ago