title: ASP.NET User Controls, ObjectDataSources, and XSS
body: <p>I am working on a web project which includes a user control (.ascx) which is housed in a repeater on the containing .aspx page. There is a DataList on the user control which is dynamically bound in the code behind. Such that the parent page/repeater assigns the data (a List) to a property on the user control, which then assigns that source to the DataSource property of the DataList. Does this create a XSS vulnerability?</p>
  
  <p>In the Repeater's ItemDataBound is a line:</p>
  
  <pre><code>&lt;object&gt;.DataSource = ((KeyValuePair&lt;..., ...&gt;)e.Item.DataItem).Value as &lt;objecttype&gt;;
  </code></pre>
  
  <p>In the codebehind of the .ascx (DataSource property):</p>
  
  <pre><code>MyDataList.DataSource = value;
  MyDataList.DataBind();
  </code></pre>
  
  <p>Thanks much.</p>