Imperfect HTML-encoding in ASP.NET MVC?

Question

I'm using the asp mvc 3. When I build my views using the default html-helpers there is a problem with html-encoding in tag-attributes: The "greater-than"-sign isn't encoded.

So this code

<%: Html.TextBox("TestText", "<Test>") %>

produces this output

<input id="TestText" name="TestText" type="text" value="&lt;Test>" />

Is there any reason why the value-attribute isn't full encoded or is this a bug? Or is there any way how to use a full encoding even in tag-attributes?

Thanx, Michael

Adeel · Accepted Answer · 2011-02-15 10:51:58Z

4

you misunderstood the <%: tag. The <%: tag only encodes normal string, not HtmlString as returned by Html.TextBox helper.

Example:

<%: Html.TextBox("TestText", "<Test>") %>
<%= Html.TextBox("TestText2", "<Test>") %>

Both statements return the same text value as mentioned in question. Now consider this statement.

<%: "<Test>" %>

This statement encodes, as now normal string is passed.

EDIT:

After checking the source code of MVC, HttpUtility.HtmlAttributeEncode is called under the hood. It minimally converts a string to an HTML-encoded string.

edited Feb 15, 2011 at 10:51

answered Feb 14, 2011 at 19:35

Adeel

19.3k4 gold badges48 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Michael Over a year ago

No - I don't misunderstood the <%: tag resspectively the <%= tag. But I wonder why a <%: "<Test>" %> is encoded correctly while the value in my example is encoded to "<Test>". I don't expect that the hole tag is encoded - I just expect that the value of an attribute is full encoded.

Michael Over a year ago

Thanx. That's what I was looking for - even if I don't understand why they don't use HtmlEncode. So I have to build my own helpers which do a full encoding.

Anonymous Apple · Accepted Answer · 2011-02-14 19:36:09Z

1

"<test>" is being HTML encoded. The greater-than character '>' by itself is harmless, which is why it wasn't converted into >

answered Feb 14, 2011 at 19:36

Anonymous Apple

1,3812 gold badges10 silver badges17 bronze badges

2 Comments

Michael Over a year ago

Even it is harmless, I can't understand, why MS uses two encoding-types. The Server.HTMLEncode works as expected - but it seems that they use another function here. My problem is that every application we publish over the internet in our company must pass a security-check. And the guys doing this check rate this fragmental encoding as a vulnerability. And no chance to discuss this...

mnemosyn Over a year ago

Maybe not worth waking up a very old thread, but MSDN says that HtmlEncode is orders of magnitude slower than HtmlAttributeEncode, which is why it is not used everywhere.

Collectives™ on Stack Overflow

Imperfect HTML-encoding in ASP.NET MVC?

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related