#Fix: Sanitize SPA JSON response within HTML response in order to avo…

…id <script> parsing conflicts. Issue: 99580
genexuslabs · Oct 27, 2022 · f199ba2 · f199ba2
1 parent c3a9eca
commit f199ba2
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/dotnet/src/dotnetframework/GxClasses/Middleware/GXHttp.cs b/dotnet/src/dotnetframework/GxClasses/Middleware/GXHttp.cs
@@ -34,6 +34,7 @@ namespace GeneXus.Http
 	using GeneXus.Web.Security;
 	using System.Linq;
 	using System.Reflection.PortableExecutable;
+	using System.Web;
 #else
 	using System.Web;
 	using System.Web.UI;
@@ -1568,7 +1569,7 @@ protected void SendState()
 				context.httpAjaxContext.AddStylesHidden();
 				if (IsSpaRequest())
 				{
-					context.WriteHtmlTextNl("<script>gx.ajax.saveJsonResponse(" + context.getJSONResponse() + ");</script>");
+					context.WriteHtmlTextNl("<script>gx.ajax.saveJsonResponse('" + GXUtil.HtmlEncodeInputValue(HttpUtility.JavaScriptStringEncode(context.getJSONResponse())) + "');</script>");
 				}
 				else
 				{