typeValidation Element Overview
As Telerik Reporting consumes report definitions, they are a potential attack vector and a malicious actor could utilize a modified report to execute an attack against a system that uses Telerik Reporting. To prevent that, the Reporting engine validates the serialization types of the report definition and the expression types used in the report. The typeValidation
element defines the configuration settings for this validation.
XML-based configuration file:
<typeValidation validateExpressionTypes="true" validateSerializationTypes="true" />
JSON-based configuration file:
"typeValidation": {
"validateExpressionTypes": "true",
"validateSerializationTypes": "true"
}
Attributes and Elements
The following sections describe attributes and parent elements.
Attributes |
|
Parent Elements |
|
Example
The following code example demonstrates how to disable the type validation performed by the Reporting Engine.
The type validation of the Reporting engine is an important security feature and disabling it can make you vulnerable to attacks! Proceed at your own risk, only if you are confident in the security of your environment.
XML-based configuration file:
<?xml version="1.0"?>
<configuration>
<configSections>
<section name="Telerik.Reporting" type="Telerik.Reporting.Configuration.ReportingConfigurationSection, Telerik.Reporting" allowLocation="true" allowDefinition="Everywhere" />
</configSections>
<Telerik.Reporting>
<typeValidation validateExpressionTypes="false" validateSerializationTypes="false" />
</Telerik.Reporting>
...
</configuration>
JSON-based configuration file:
"telerikReporting": {
"typeValidation": {
"validateExpressionTypes": "false",
"validateSerializationTypes": "false"
}
}
When adding the
Telerik.Reporting
section manually, do not forget to register it in theconfigSections
element of the configuration file. Failing to do so will result in a ConfigurationErrorsException with the following text: Configuration system failed to initialize.