I am using the 10.1 version of the Infragistics Spell Checker and noticed a potential security issue with the way the control is being rendered. I am using a custom dictionary and my mark up looks like this:
<ig_spell:WebSpellChecker id="WebSpellChecker1" WebSpellCheckerDialogPage="http://localhost/SpellCheck.aspx" runat="server" ><DialogOptions Modal ="True" WindowHeight="410" WindowWidth="400" /> </ig_spell:WebSpellChecker>
In the code behind I set the path to UserDictionaryFile (I dont want to expose the path to the custom dictionary in the mark up)
WebSpellChecker1.UserDictionaryFile="..."
The issue is that when the control is rendered the path to the custom dictionary file is exposed in the mark up in the browser as seen below.
try{ var oClaimWebSpellChecker = ig_CreateWebSpellChecker([["WebSpellChecker1", "WebSpellChecker1", false, "-1", true, false, true, true, "English", true, true, "http%3a%2f%localhost%2fSpellCheck.aspx", false, true, false, "Spell+Checking+Document...", "HASHING_SUGGESTIONS", true, "", "..%5ccustomdic.dict", 410, 400, 100, 100, false, false, true, "", "", true, "", "", "", "3", ],[["GetText","",false],["SetText","",false],["SpellCheckComplete","spellCheckComplete",false],["WordCorrected","",false],["BeforeSpellCheckBegins","",false]],[],[]]);}catch(e){window.status="Can't init script for WebSpellChecker";}
The security folks inmy company do not like this. Is there any way around this issue?
Hi,
I am sorry, but the WebSpellChecker doesn't currently have any support for hiding the path to the custom dictionary file. And there is not easy workaround here, because this file path is passed from the spellchecker to the dialog window as well. You can contact our developer support and they can create a feature request for you for this issue.
Thank You,
Olga