Your Privacy Matters: We use our own and third-party cookies to improve your experience on our website. By continuing to use the website we understand that you accept their use. Cookie Policy
65
Security Risk - WebSpellChecker Custom dictionary path
posted

I am using the 10.1 version of the Infragistics Spell Checker and noticed a potential security issue with the way the control is being rendered. I am using a custom dictionary and my mark up looks like this:

<ig_spell:WebSpellChecker id="WebSpellChecker1"  WebSpellCheckerDialogPage="http://localhost/SpellCheck.aspx"   runat="server" >
<DialogOptions   Modal ="True" WindowHeight="410" WindowWidth="400"  />                         
</ig_spell:WebSpellChecker>

In the code behind I set the path to UserDictionaryFile (I dont want to expose the path to the custom dictionary in the mark up)

WebSpellChecker1.UserDictionaryFile="..."

The issue is that when the control is rendered the path to the custom dictionary file is exposed in the mark up in the browser as seen below.

try{ var oClaimWebSpellChecker = ig_CreateWebSpellChecker([["WebSpellChecker1", "WebSpellChecker1", false, "-1", true, false, true, true, "English", true, true, "http%3a%2f%localhost%2fSpellCheck.aspx", false, true, false, "Spell+Checking+Document...", "HASHING_SUGGESTIONS", true, "", "..%5ccustomdic.dict", 410, 400, 100, 100, false, false, true, "", "", true, "", "", "", "3", ],[["GetText","",false],["SetText","",false],["SpellCheckComplete","spellCheckComplete",false],["WordCorrected","",false],["BeforeSpellCheckBegins","",false]],[],[]]);}catch(e){window.status="Can't init script for WebSpellChecker";}

The security folks inmy company do not like this. Is there any way around this issue?

  • 2783
    posted

    Hi,

     

    I am sorry, but the WebSpellChecker doesn't currently have any support for hiding the path to the custom dictionary file.  And there is not easy workaround here, because this file path is passed from the spellchecker to the dialog window as well.  You can contact our developer support and they can create a feature request for you for this issue.

     

    Thank You,

     

    Olga