Welcome to the Lounge

Nicholas Marty9-Sep-15 0:42

Nicholas Marty

9-Sep-15 0:42

In my opinion the cleanest way to do this is to disable the check.
You can disable it for a single control (.NET 4.5 +) or a single page if you don't want to disable it for everything.
The check is just there to prevent sending potentially malicious data to applications that don't need it (which probably covers most applications).

If you don't want to do that, I'd probably base64 encode the data.

Sander Rossel9-Sep-15 1:27

9-Sep-15 1:27

Smart, haven't seen that one yet Thumbs Up | :thumbsup:

So far I've got five unofficial and zero official solutions to this problem Laugh | :laugh:

Visit my blog at Sander's bits - Writing the code you need.
Or read my articles at my CodeProject profile.

Regards,
Sander

Kornfeld Eliyahu Peter9-Sep-15 0:45

Kornfeld Eliyahu Peter

9-Sep-15 0:45

I think jQuery can help you there (and even you had not ask a strict programming question I answer it as one)...
You can use a combination of text() and html() methods...

This will encode HTML (value):

JavaScript

return $('<div/>').text(value).html();

and this will decode:

JavaScript

return $('<div/>').html(value).text();

I left it for you too go and read the reference pages...

Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.

Sander Rossel9-Sep-15 1:21

9-Sep-15 1:21

That helps and I just so happen to have jQuery available Thumbs Up | :thumbsup:

Visit my blog at Sander's bits - Writing the code you need.
Or read my articles at my CodeProject profile.

Regards,
Sander

Jörgen Andersson9-Sep-15 1:00

Jörgen Andersson

9-Sep-15 1:00

Try

JavaScript

function htmlEncode( html ) {
    return document.createElement( 'a' ).appendChild( 
        document.createTextNode( html ) ).parentNode.innerHTML;
};

for pure javascript.

Wrong is evil and must be defeated. - Jeff Ello

Sander Rossel9-Sep-15 1:25

9-Sep-15 1:25

That helps too, which is the fifth unofficial method to solving this problem Thumbs Up | :thumbsup:

Visit my blog at Sander's bits - Writing the code you need.
Or read my articles at my CodeProject profile.

Regards,
Sander

Jörgen Andersson9-Sep-15 1:35

Jörgen Andersson

9-Sep-15 1:35

I would use one of the other methods though, this ugly piece I would use only as a last resort.

Wrong is evil and must be defeated. - Jeff Ello

programming question

_Maxxx_9-Sep-15 1:08

_Maxxx_

9-Sep-15 1:08

No ish about it, really

PooperPig - Coming Soon

Sander Rossel9-Sep-15 1:19

9-Sep-15 1:19

I never asked for it to be solved as there are obviously multiple ways to go about it and I've mentioned two.
And then other people mentioned more.
It's more of a frustration rant about why there is no official standard solution for this problem Smile | :)

Visit my blog at Sander's bits - Writing the code you need.
Or read my articles at my CodeProject profile.

Regards,
Sander

Kornfeld Eliyahu Peter9-Sep-15 1:21

Kornfeld Eliyahu Peter

9-Sep-15 1:21

Do not make excuses! Stand against the wall!

Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.

Sander Rossel9-Sep-15 1:28

9-Sep-15 1:28

"But, but..."
*POW!*
Dead | X|

Visit my blog at Sander's bits - Writing the code you need.
Or read my articles at my CodeProject profile.

Regards,
Sander

Brittle16189-Sep-15 1:49

Brittle1618

9-Sep-15 1:49

Ain't it a bit more hard punishment than the mistake he made? Big Grin | :-D

Kornfeld Eliyahu Peter9-Sep-15 1:51

Kornfeld Eliyahu Peter

9-Sep-15 1:51

Why it is so hard to stand against the wall?

(It is my imagination, or you heard some gunshots? There were nothing... $Shucks | :-\$ )

Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.

Brittle16189-Sep-15 2:01

Brittle1618

9-Sep-15 2:01

I was actually relating the Lounge with the class room where teacher orders the poor student to stand against the wall(as a punishment)

I actually heard the laughters of the class-mates upon the punishment. Laugh | :laugh:

newton.saber9-Sep-15 1:51

newton.saber

9-Sep-15 1:51

Consider why this is a difficult thing to do with no standard solution.
It is because it is an odd thing to do.
That sounded very rude so I hope you are still with me. (I'm really not trying to be rude, just direct.)

What I mean is that you are posting the data (expected) and the template (unexpected).
Here, by template, I mean HTML.
HTML is really just a template.

I'm on the outside of your solution so I immediately think, "Why? Why is Sander posting HTML, when the HTML (template) should be described at the server side? Why would he post HTML when that is surely described on the server side? Since it is on the server side, the server doesn't need the template data posted since it already has it."

The only reason I can figure is that you are allowing users to post markup for their posts something like you can do here in this forum. Is that it?

If it is, then this will always be a challenge, because now you actually have to become an HTML parser because now instead of allowing a browser to handle the __template__ you have to pull out the bytes which represent the __template__ and separate them from the bytes which are the data.

Well, I'm not offering much of a solution, but possibly a different take on what is really going on.
I think separation of concerns leads us to think more clearly about each piece of a solution.
Hopefully I've added something to this discussion.

Sander Rossel9-Sep-15 2:59

9-Sep-15 2:59

Yeah, thanks. You're right.
It is an odd thing to do.
And indeed the user can add markup to stuff.

Ultimately I've just disabled the check, since it's an internal intranet application and the customer has explicitly asked to be able to do HTML markup.
I leave it to them to not use script tags and that kind of stuff.
I've already secured it a bit with an HTML editor that translates <> typed by the user to <> so it ain't that bad Smile | :)

Just don't hack the browser or post HTTP requests directly.
Although that can be considered bad intent and cost employees their job and who knows more (which still doesn't make the data right though).

Visit my blog at Sander's bits - Writing the code you need.
Or read my articles at my CodeProject profile.

Regards,
Sander

GenJerDan9-Sep-15 6:19

GenJerDan

9-Sep-15 6:19

You could do a check to disallow any scripting, etc. Let "normal" HTML through, but remove any 'dangerous' tags.

We won't sit down.
We won't shut up.
We won't go quietly away.

YouTube
and
My Mu[sic], Films and Windows Programs, etc.

Ferd Really9-Sep-15 4:43

Ferd Really

9-Sep-15 4:43

If it is on MSDN can it be considered standard?

HttpUtility.HtmlEncode Method (String)
Converts a string to an HTML-encoded string.[^]

There are strangers on the Plain, Croaker

Sander Rossel9-Sep-15 5:32