Hello
" }, + new UserRecord { Id = 2, UserName = "bob_02", Email = "bob@example.com", NotesHtml = "Team lead
" } + }; + + private EditContext editContext; + + protected override void OnInitialized() + { + editContext = new EditContext(new UserRecord()); + } + + private Task OnValidSubmit() + { + // Server operations: canonicalize, validate, sanitize HTML again, then persist. + return Task.CompletedTask; + } +} + +{% endhighlight %} +{% endtabs %} + +## Logging and Rejecting Malformed Payloads + +Reject invalid models and log structured details for security monitoring. Log anomalies (e.g., repeated failed validations, suspicious payload shapes) at appropriate levels and avoid storing raw malicious input without redaction. + +{% tabs %} +{% highlight razor %} + +if (!ModelState.IsValid) +{ + _logger.LogWarning("Validation failed: {@Errors}", ModelState + .Where(kvp => kvp.Value?.Errors.Count > 0) + .ToDictionary(k => k.Key, v => v.Value!.Errors.Select(e => e.ErrorMessage))); + + return BadRequest(ModelState); +} + +{% endhighlight %} +{% endtabs %} + +Logging validation failures provides visibility into suspicious behavior while preventing harmful data from entering the system. + +## See also + +[Data Annotation in Blazor DataGrid](https://blazor.syncfusion.com/documentation/datagrid/data-annotation) +[Xhtml validation in Rich Text Editor](https://blazor.syncfusion.com/documentation/rich-text-editor/xhtml-validation) +[Create Edit Forms with FluentValidation and Syncfusion® Blazor Components](https://www.syncfusion.com/blogs/post/create-edit-forms-with-fluentvalidation-and-syncfusion-blazor-components) From 3df038111778d78cac298ac835343505641fceb6 Mon Sep 17 00:00:00 2001 From: ponselvajeganathan <68591831+ponselvajeganathan@users.noreply.github.com> Date: Mon, 2 Mar 2026 19:42:53 +0530 Subject: [PATCH 2/5] 1011008: updated --- blazor/common/security/input-sanitization.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blazor/common/security/input-sanitization.md b/blazor/common/security/input-sanitization.md index f4b97faf0f..d0a4533e96 100644 --- a/blazor/common/security/input-sanitization.md +++ b/blazor/common/security/input-sanitization.md @@ -1,13 +1,13 @@ --- layout: post title: Input Sanitization in Syncfusion Blazor Components -description: Learn how to implement secure input sanitization when using Syncfusion Blazor components. +description: Discover effective techniques for securely sanitizing user input in Syncfusion Blazor components to protect your application from unsafe data. platform: Blazor control: Common documentation: ug --- -# Input Sanitization in Syncfusion Blazor Components +# Input Sanitization with Syncfusion Blazor Components Input sanitization protects applications from malformed or malicious user input by validating, cleaning, and transforming data before it is processed. Syncfusion Blazor components provide rich client‑side validation capabilities, but all input must still be validated and sanitized on the server to maintain a complete security boundary. This guide explains how to implement secure and consistent input sanitization patterns when working with Syncfusion Blazor components. From 2da0e9a75e5f795111e058c0c03f2ddffd2cfbdb Mon Sep 17 00:00:00 2001 From: ponselvajeganathan <68591831+ponselvajeganathan@users.noreply.github.com> Date: Tue, 3 Mar 2026 12:29:31 +0530 Subject: [PATCH 3/5] 1011008: Modify --- blazor/common/security/input-sanitization.md | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/blazor/common/security/input-sanitization.md b/blazor/common/security/input-sanitization.md index d0a4533e96..751eafd79d 100644 --- a/blazor/common/security/input-sanitization.md +++ b/blazor/common/security/input-sanitization.md @@ -17,17 +17,17 @@ Input sanitization protects applications from malformed or malicious user input Client-side validation improves the user experience by providing immediate feedback and reducing unnecessary server calls. Syncfusion components offer built‑in features such as `MaxLength`, `masked input`, and `form‑bound validation`. These client-side checks help users correct mistakes early, but they should never be considered authoritative. -### Revalidate on the Server +### Re-validate on the Server -Server-side validation must always be performed regardless of the client’s behavior. The server should enforce rules using **DataAnnotations**, allowlists, HTML sanitization libraries, and `ModelState` validation. Even if the client reports valid data, the server must treat all inputs as untrusted. +Server-side validation must always be performed regardless of the client’s behavior. The server should enforce rules using **DataAnnotations**, allow-lists, HTML sanitization libraries, and `ModelState` validation. Even if the client reports valid data, the server must treat all inputs as untrusted. ### Canonicalize Inputs Before validation, normalize incoming data—trim whitespace, normalize Unicode, decode entities, and standardize encodings. Canonicalizing inputs prevents attackers from exploiting encoded variations or visually deceptive input forms. -### Prefer Allowlisting +### Prefer Allow-listing -Whenever possible, define explicitly which characters, MIME types, or data formats are allowed. Blocklisting harmful patterns is incomplete and bypassable, whereas allowlisting offers predictable and secure boundaries. +Whenever possible, define explicitly which characters, MIME types, or data formats are allowed. Block-listing harmful patterns is incomplete and by-passable, whereas allow-listing offers predictable and secure boundaries. ## DataAnnotations Model Validation @@ -88,16 +88,12 @@ Syncfusion components integrate naturally with Blazor’s form validation and gi