General Security Considerations
- 4 minutes to read
This topic documents how to mitigate security risks when deploying a DevExpress powered web-based reporting application.
Important
If you have not yet done so, be sure to review the following help topic: Security Considerations for Report Storage and Distribution.
Cross-site Scripting (XSS) Security
Client-side reporting controls are protected against script injection. Property values are always encoded when they are exported to HTML.
Web End-User Report Designer
A user can add a “javascript:” prefix to the XRControl.NavigateUrl property value. This allows the link to execute JavaScript code on the client and leaves other users vulnerable to cross-site scripting (XSS) attacks.
Web Document Viewer
The Document Viewer’s initial settings do not allow JavaScript code execution within the XRControl.NavigateUrl property values. If your application relies on scripts in URLs, use the AllowURLsWithJSContent property to enable URLs with JavaScript in the ASP.NET Web Forms, ASP.NET MVC and ASP.NET Core platforms.
Protect Sensitive Information
Ensure Authorized Access
For access control purposes, all operations can be classified by the object that the document viewer processes within a specific operation. The objects are:
- Reports
- Documents
- Document export results.
To implement authorized access to these objects in a reporting application, review the following help topic: Authorized Access to Reports and Documents in a Web Reporting Application.
Avoid Sensitive Data Exposure Through Report URL
A report URL (report string identifier) is a string that contains a report name, report parameters, and may contain other information. A client method that opens a report will send this string to the server. The string may reveal sensitive information, such as an application’s internal structure.
Make certain that the report URL does not contain sensitive information. Implement custom report name resolution services to detect and remove unnecessary information from report string identifiers. The following services are available:
- IWebDocumentViewerReportResolver
- Allows you to parse a report name, create a report instance, and return it to the calling method. If you have a parameterized report, you can specify parameters in the report name passed to the service and use parameters within the report’s constructor.
Note
The IWebDocumentViewerReportResolver service does not support asynchronous mode.
- ICachedReportSourceWebResolver
- Returns an instance of CachedReportSourceWeb. The ICachedReportSourceWebResolverAsync service allows you to build a document asynchronously.
- IReportProvider
- This service has lower priority than previously mentioned services (and is not intended for exclusive use by the Document Viewer). The primary advantage of IReportProvider service is that it can be attached to reports created at runtime. IReportProviderAsync uses asynchronous operations.
- ReportStorageWebExtension
- This service is called when no other report name resolution services are available. It is designed to obtain reports (stored in our REPX format) from external storage (a file or a database). Note that the GetData method returns a serialized report. If you use the GetData method to specify the default parameter value for a loaded report, set the Value property to the parameter value.
Ensure Safe Image Loading from URL
The XRPictureBox.ImageUrl property does not accept the “file://“ protocol out-of-the-box (it only accepts ‘http://‘, “https://“ and “ftp://“ protocols). The same rule applies to the XRRichText report control for images in the IncludePicture fields.
To use the “file://“ protocol in image URLs, use the DevExpress.Security.Resources.AccessSettings class to apply access rules that enable image loading from specified locations.
Protect Passwords on the Client Side
Passwords for PDF and Excel files with other export options are always passed in a POST request (to exclude them from browser history).
If users share a report, passwords specified for PDF and Excel files are not exposed in the Web Document Viewer. A user who has access to documents exported by other users cannot bypass password protection.
Call the EnablePassingExportOptionsPasswordsToClient method at application startup to pass PDF/Excel passwords (specified in the Report Designer) to the Web Document Viewer on ASP.NET Web Forms & MVC and ASP.NET Core platforms.
Protect Passwords on the Server Side
The report definition (REPX) file stores PDF/Excel passwords in plain text. Ensure that only trusted parties have access to report definition files.
Disable Report Scripts
Important
Report scripts are insecure. Use Expressions or ExpressionsAdvanced data binding modes instead. For more information, review the following help topic: Data Binding Modes.
For security reasons the Web End-User Report Designer is initially configured to prohibit script execution, view, and edit operations. For information on how to enable scripts in the Web End-User Report Designer, review the following help topic: Scripts Security.