Discussion on: Passing serialized C# object in JSON to Razor Page

[Justin J Stark]

Be careful with Html.Raw. It can lead to XSS attacks.

For instance, what if somebody puts in the JSON data:

{
    Data1: 'Something',
    Data2: '<script src="https://SomeXSSUrl"></script>'
}

Will the script render? If so, you've just opened a security hole.

A better method is to read the data after the page loads with an AJAX call. This means your data is never loaded on the page so a script cannot be injected. With JQuery:

$(document).ready(function(){
    $.get( getJsonData", function(data) {
        //Now you have your data. Use it to load your component.
    });
});