ASP.NET MVC - HtmlEncode all strings by default

Question

For example, a user creates a new question on a forum.

I send ajax to the server, then I use HtmlEncode to exclude the HTML code before saving it in the database.

Is it possible that HtmlEncode would be used automatically when receiving a request?

Also, when using the attribute (for example [HtmlAllowed]) you can allow html code in request.

Thanks

Yehor Androsov · Accepted Answer · 2020-02-19 09:43:11Z

1

You can achieve it using custom model binder, every string property or string parameter will go through this method when ASP.NET attempts to bind request to parameters of action method

public class StringBinder : IModelBinder
{
    public object BindModel(ControllerContext controllerContext, ModelBindingContext bindingContext)
    {
        ValueProviderResult value = bindingContext.ValueProvider.GetValue(bindingContext.ModelName);
        bindingContext.ModelState.SetModelValue(bindingContext.ModelName, value);

        var str = (string)value?.ConvertTo(typeof(string));

        str = HttpUtility.HtmlEncode(str);
        return str;
    }
}

And in Application_Start()

ModelBinders.Binders.Add(typeof(string), new StringBinder());

answered Feb 19, 2020 at 9:43

Yehor Androsov

6,1862 gold badges30 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Alexander Grek Over a year ago

This code throws an exception HttpRequestValidationException even with [AllowHtml] or [ValidateInput(false)]. Found a solution to use Request.Unvalidated

Yehor Androsov Over a year ago

yeah, looks like my my input strings were already processed, so it went through binder fine. glad it helped to find correct solution. you might want to accept your own answer

Alexander Grek · Accepted Answer · 2020-10-30 12:58:07Z

Thanks to Yegor Androsov, for pointing me to right direction.

This ModelBinder automaticaly encode all string properties, except that has [SafeHtml] attribute

public class SafeStringModelBinder : IModelBinder
{
    public object BindModel(ControllerContext controllerContext, ModelBindingContext bindingContext)
    {
        HttpRequestBase request = controllerContext.HttpContext.Request;
        string name = bindingContext.ModelName;
        string value = request.Unvalidated[name];

        Type holderType = bindingContext.ModelMetadata.ContainerType;
        if (holderType != null)
        {
            PropertyInfo propertyType = holderType.GetProperty(bindingContext.ModelMetadata.PropertyName);
            if (propertyType == null) return value;

            object[] attributes = propertyType.GetCustomAttributes(true);
            bool hasAttribute = attributes.Cast<Attribute>().Any(a => a.GetType() == typeof (SafeHtmlAttribute));

            if (!hasAttribute && !string.IsNullOrEmpty(value))
            {
                value = HttpUtility.HtmlEncode(value);
            }
        }

        return value;
    }
}

[AttributeUsage(AttributeTargets.Property)]
public class SafeHtmlAttribute : Attribute { }

Collectives™ on Stack Overflow

ASP.NET MVC - HtmlEncode all strings by default

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related