yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Properly HTML encode text in helper methods (#6545)

Browse Source
This commit is contained in:
Ronald Barendse
2020-06-19 11:41:16 +02:00
committed by GitHub
parent a9bd2ae856
commit 0886ada39c
5 changed files with 489 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
src/Umbraco.Web/HtmlHelperRenderExtensions.cs
View File

@@ -253,12 +253,12 @@ namespace Umbraco.Web
}
/// <summary>
/// Helper method to create a new form to execute in the Umbraco request pipeline against a locally declared controller
/// Helper method to create a new form to execute in the Umbraco request pipeline against a locally declared controller.
/// </summary>
/// <param name="html"></param>
/// <param name="action"></param>
/// <param name="controllerName"></param>
/// <param name="method"></param>
/// <param name="html">The HTML helper.</param>
/// <param name="action">Name of the action.</param>
/// <param name="controllerName">Name of the controller.</param>
/// <param name="method">The method.</param>
/// <returns></returns>
public static MvcForm BeginUmbracoForm(this HtmlHelper html, string action, string controllerName, FormMethod method)
{
@@ -315,9 +315,9 @@ namespace Umbraco.Web
/// <param name="method"></param>
/// <returns></returns>
public static MvcForm BeginUmbracoForm(this HtmlHelper html, string action, string controllerName,
object additionalRouteVals,
object htmlAttributes,
FormMethod method)
object additionalRouteVals,
object htmlAttributes,
FormMethod method)
{
return html.BeginUmbracoForm(action, controllerName, additionalRouteVals, HtmlHelper.AnonymousObjectToHtmlAttributes(htmlAttributes), method);
}
@@ -332,8 +332,8 @@ namespace Umbraco.Web
/// <param name="htmlAttributes"></param>
/// <returns></returns>
public static MvcForm BeginUmbracoForm(this HtmlHelper html, string action, string controllerName,
object additionalRouteVals,
object htmlAttributes)
object additionalRouteVals,
object htmlAttributes)
{
return html.BeginUmbracoForm(action, controllerName, additionalRouteVals, HtmlHelper.AnonymousObjectToHtmlAttributes(htmlAttributes));
}
@@ -349,9 +349,9 @@ namespace Umbraco.Web
/// <param name="method"></param>
/// <returns></returns>
public static MvcForm BeginUmbracoForm(this HtmlHelper html, string action, string controllerName,
object additionalRouteVals,
IDictionary<string, object> htmlAttributes,
FormMethod method)
object additionalRouteVals,
IDictionary<string, object> htmlAttributes,
FormMethod method)
{
if (action == null) throw new ArgumentNullException(nameof(action));
if (string.IsNullOrWhiteSpace(action)) throw new ArgumentException("Value can't be empty or consist only of white-space characters.", nameof(action));
@@ -371,8 +371,8 @@ namespace Umbraco.Web
/// <param name="htmlAttributes"></param>
/// <returns></returns>
public static MvcForm BeginUmbracoForm(this HtmlHelper html, string action, string controllerName,
object additionalRouteVals,
IDictionary<string, object> htmlAttributes)
object additionalRouteVals,
IDictionary<string, object> htmlAttributes)
{
if (action == null) throw new ArgumentNullException(nameof(action));
if (string.IsNullOrWhiteSpace(action)) throw new ArgumentException("Value can't be empty or consist only of white-space characters.", nameof(action));
@@ -840,19 +840,32 @@ namespace Umbraco.Web
#region If
/// <summary>
/// If the test is true, the string valueIfTrue will be returned, otherwise the valueIfFalse will be returned.
/// If <paramref name="test" /> is <c>true</c>, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <see cref="string.Empty" />.
/// </summary>
public static IHtmlString If(this HtmlHelper html, bool test, string valueIfTrue, string valueIfFalse)
/// <param name="html">The HTML helper.</param>
/// <param name="test">If set to <c>true</c> returns <paramref name="valueIfTrue" />; otherwise, <see cref="string.Empty" />.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
public static IHtmlString If(this HtmlHelper html, bool test, string valueIfTrue)
{
return test ? new HtmlString(valueIfTrue) : new HtmlString(valueIfFalse);
return If(html, test, valueIfTrue, string.Empty);
}
/// <summary>
/// If the test is true, the string valueIfTrue will be returned, otherwise the valueIfFalse will be returned.
/// If <paramref name="test" /> is <c>true</c>, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
public static IHtmlString If(this HtmlHelper html, bool test, string valueIfTrue)
/// <param name="html">The HTML helper.</param>
/// <param name="test">If set to <c>true</c> returns <paramref name="valueIfTrue" />; otherwise, <paramref name="valueIfFalse" />.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
public static IHtmlString If(this HtmlHelper html, bool test, string valueIfTrue, string valueIfFalse)
{
return test ? new HtmlString(valueIfTrue) : new HtmlString(string.Empty);
return new HtmlString(HttpUtility.HtmlEncode(test ? valueIfTrue : valueIfFalse));
}
#endregion
@@ -862,16 +875,32 @@ namespace Umbraco.Web
private static readonly HtmlStringUtilities StringUtilities = new HtmlStringUtilities();
/// <summary>
/// Replaces text line breaks with HTML line breaks
/// Replaces text line breaks with HTML line breaks.
/// </summary>
/// <param name="helper"></param>
/// <param name="helper">The HTML helper.</param>
/// <param name="text">The text.</param>
/// <returns>The text with text line breaks replaced with HTML line breaks (<br/>)</returns>
/// <returns>
/// The text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).
/// </returns>
[Obsolete("This method doesn't HTML encode the text. Use ReplaceLineBreaks instead.")]
public static IHtmlString ReplaceLineBreaksForHtml(this HtmlHelper helper, string text)
{
return StringUtilities.ReplaceLineBreaksForHtml(text);
}
/// <summary>
/// HTML encodes the text and replaces text line breaks with HTML line breaks.
/// </summary>
/// <param name="helper">The HTML helper.</param>
/// <param name="text">The text.</param>
/// <returns>
/// The HTML encoded text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).
/// </returns>
public static IHtmlString ReplaceLineBreaks(this HtmlHelper helper, string text)
{
return StringUtilities.ReplaceLineBreaks(text);
}
/// <summary>
/// Generates a hash based on the text string passed in. This method will detect the
/// security requirements (is FIPS enabled) and return an appropriate hash.

14
src/Umbraco.Web/HtmlStringUtilities.cs
View File

@@ -16,21 +16,25 @@ namespace Umbraco.Web
public sealed class HtmlStringUtilities
{
/// <summary>
/// Replaces text line breaks with HTML line breaks
/// Replaces text line breaks with HTML line breaks.
/// </summary>
/// <param name="text">The text.</param>
/// <returns>The text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).
/// <returns>
/// The text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).
/// </returns>
[Obsolete("This method doesn't HTML encode the text. Use ReplaceLineBreaks instead.")]
public HtmlString ReplaceLineBreaksForHtml(string text)
{
return new HtmlString(text.Replace("\r\n", @"<br />").Replace("\n", @"<br />").Replace("\r", @"<br />"));
return new HtmlString(text.Replace("\r\n", @"<br />").Replace("\n", @"<br />").Replace("\r", @"<br />"));
}
/// <summary>
/// HTML encodes the text and replaces text line breaks with HTML line breaks.
/// </summary>
/// <param name="text">The text.</param>
/// <returns>The HTML encoded text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).</returns>
/// <returns>
/// The HTML encoded text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).
/// </returns>
public IHtmlString ReplaceLineBreaks(string text)
{
var value = HttpUtility.HtmlEncode(text)?

2
src/Umbraco.Web/Mvc/HtmlTagWrapperTextNode.cs
View File

@@ -12,7 +12,7 @@ namespace Umbraco.Web.Mvc
public void WriteToHtmlTextWriter(System.Web.UI.HtmlTextWriter html)
{
html.Write(Content);
html.WriteEncodedText(Content);
}
}
}

149
src/Umbraco.Web/PublishedContentExtensions.cs
View File

@@ -287,29 +287,82 @@ namespace Umbraco.Web
return content.Id == other.Id;
}
/// <summary>
/// If the specified <paramref name="content" /> is equal to <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <see cref="string.Empty" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsEqual(this IPublishedContent content, IPublishedContent other, string valueIfTrue)
{
return content.IsEqual(other, valueIfTrue, string.Empty);
}
/// <summary>
/// If the specified <paramref name="content" /> is equal to <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsEqual(this IPublishedContent content, IPublishedContent other, string valueIfTrue, string valueIfFalse)
{
return new HtmlString(content.IsEqual(other) ? valueIfTrue : valueIfFalse);
return new HtmlString(HttpUtility.HtmlEncode(content.IsEqual(other) ? valueIfTrue : valueIfFalse));
}
/// <summary>
/// If the specified <paramref name="content" /> is not equal to <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static bool IsNotEqual(this IPublishedContent content, IPublishedContent other)
{
return content.IsEqual(other) == false;
}
/// <summary>
/// If the specified <paramref name="content" /> is not equal to <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <see cref="string.Empty" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsNotEqual(this IPublishedContent content, IPublishedContent other, string valueIfTrue)
{
return content.IsNotEqual(other, valueIfTrue, string.Empty);
}
/// <summary>
/// If the specified <paramref name="content" /> is not equal to <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsNotEqual(this IPublishedContent content, IPublishedContent other, string valueIfTrue, string valueIfFalse)
{
return new HtmlString(content.IsNotEqual(other) ? valueIfTrue : valueIfFalse);
return new HtmlString(HttpUtility.HtmlEncode(content.IsNotEqual(other) ? valueIfTrue : valueIfFalse));
}
#endregion
@@ -321,14 +374,35 @@ namespace Umbraco.Web
return other.Level < content.Level && content.Path.InvariantStartsWith(other.Path.EnsureEndsWith(','));
}
/// <summary>
/// If the specified <paramref name="content" /> is a decendant of <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <see cref="string.Empty" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsDescendant(this IPublishedContent content, IPublishedContent other, string valueIfTrue)
{
return content.IsDescendant(other, valueIfTrue, string.Empty);
}
/// <summary>
/// If the specified <paramref name="content" /> is a decendant of <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsDescendant(this IPublishedContent content, IPublishedContent other, string valueIfTrue, string valueIfFalse)
{
return new HtmlString(content.IsDescendant(other) ? valueIfTrue : valueIfFalse);
return new HtmlString(HttpUtility.HtmlEncode(content.IsDescendant(other) ? valueIfTrue : valueIfFalse));
}
public static bool IsDescendantOrSelf(this IPublishedContent content, IPublishedContent other)
@@ -336,14 +410,35 @@ namespace Umbraco.Web
return content.Path.InvariantEquals(other.Path) || content.IsDescendant(other);
}
/// <summary>
/// If the specified <paramref name="content" /> is a decendant of <paramref name="other" /> or are the same, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <see cref="string.Empty" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsDescendantOrSelf(this IPublishedContent content, IPublishedContent other, string valueIfTrue)
{
return content.IsDescendantOrSelf(other, valueIfTrue, string.Empty);
}
/// <summary>
/// If the specified <paramref name="content" /> is a decendant of <paramref name="other" /> or are the same, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsDescendantOrSelf(this IPublishedContent content, IPublishedContent other, string valueIfTrue, string valueIfFalse)
{
return new HtmlString(content.IsDescendantOrSelf(other) ? valueIfTrue : valueIfFalse);
return new HtmlString(HttpUtility.HtmlEncode(content.IsDescendantOrSelf(other) ? valueIfTrue : valueIfFalse));
}
public static bool IsAncestor(this IPublishedContent content, IPublishedContent other)
@@ -351,14 +446,35 @@ namespace Umbraco.Web
return content.Level < other.Level && other.Path.InvariantStartsWith(content.Path.EnsureEndsWith(','));
}
/// <summary>
/// If the specified <paramref name="content" /> is an ancestor of <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <see cref="string.Empty" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsAncestor(this IPublishedContent content, IPublishedContent other, string valueIfTrue)
{
return content.IsAncestor(other, valueIfTrue, string.Empty);
}
/// <summary>
/// If the specified <paramref name="content" /> is an ancestor of <paramref name="other" />, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsAncestor(this IPublishedContent content, IPublishedContent other, string valueIfTrue, string valueIfFalse)
{
return new HtmlString(content.IsAncestor(other) ? valueIfTrue : valueIfFalse);
return new HtmlString(HttpUtility.HtmlEncode(content.IsAncestor(other) ? valueIfTrue : valueIfFalse));
}
public static bool IsAncestorOrSelf(this IPublishedContent content, IPublishedContent other)
@@ -366,14 +482,35 @@ namespace Umbraco.Web
return other.Path.InvariantEquals(content.Path) || content.IsAncestor(other);
}
/// <summary>
/// If the specified <paramref name="content" /> is an ancestor of <paramref name="other" /> or are the same, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <see cref="string.Empty" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsAncestorOrSelf(this IPublishedContent content, IPublishedContent other, string valueIfTrue)
{
return content.IsAncestorOrSelf(other, valueIfTrue, string.Empty);
}
/// <summary>
/// If the specified <paramref name="content" /> is an ancestor of <paramref name="other" /> or are the same, the HTML encoded <paramref name="valueIfTrue" /> will be returned; otherwise, <paramref name="valueIfFalse" />.
/// </summary>
/// <param name="content">The content.</param>
/// <param name="other">The other content.</param>
/// <param name="valueIfTrue">The value if <c>true</c>.</param>
/// <param name="valueIfFalse">The value if <c>false</c>.</param>
/// <returns>
/// The HTML encoded value.
/// </returns>
// TODO: This method should be removed or moved to an extension method on HtmlHelper.
public static HtmlString IsAncestorOrSelf(this IPublishedContent content, IPublishedContent other, string valueIfTrue, string valueIfFalse)
{
return new HtmlString(content.IsAncestorOrSelf(other) ? valueIfTrue : valueIfFalse);
return new HtmlString(HttpUtility.HtmlEncode(content.IsAncestorOrSelf(other) ? valueIfTrue : valueIfFalse));
}
#endregion