Displaying User Input - Part 2
Back in June I posted a cryptic little entry that highlighted a potential issue that can arise when displaying user input.
http://weblogs.asp.net/dneimke/posts/8566.aspx
By now we all know that, when rendering user input to the browser that it needs to be HtmlEncoded right... but, what about if you need to display user input into a TextBox? HtmlEncoding it will make it unreadable and (as per my initial post) doing nothing with it will leave you exposed if the user entered something like:
</TEXTAREA><SCRIPT>self.location = 'raceyRhonda.com'</SCRIPT>
My solution to this problem is to emit the user input into a client-side variable and then load it into the TextBox at runtime. Here is a silly demo the explains what I'm blabbing about:
************ WEB FORM **************** <HTML><body> <form id="Form1" method="post" runat="server"> <P> Enter an expression and it will be emitted into the Textbox on PostBack... <BR> <asp:TextBox id="newTestTextBox" runat="server" TextMode="MultiLine" Rows="5" Columns="40"></asp:TextBox> <asp:Button id="testButton" runat="server" Width="72px" Text="Test" /> </P> <P> <HR width="100%" SIZE="1"> </P> <P>Your pattern is: <BR> <asp:TextBox id="outputTextBox" runat="server" Width="504px" /> <BR> <asp:Label id="outputLabel" runat="server"></asp:Label></P> </form> </body></HTML> ************ CODEBEHIND ************** private void testButton_Click(object sender, System.EventArgs e) { string source = CleanString( newTestTextBox.Text ) ; EmitLoadScript( source ) ; outputLabel.Text = Server.HtmlEncode( newTestTextBox.Text ) ; } private string CleanString( string s ) { string tmp = s ; if( tmp.Trim().Length > 0 ) { tmp = Regex.Replace( tmp, @"(?'cleanItem'[\\\/'""])", "\\${cleanItem}" ).Trim() ; } return tmp ; } private void EmitLoadScript( string s ) { StringBuilder sb = new StringBuilder() ; sb.AppendFormat( @"{0}<script>{0}", Environment.NewLine ) ; sb.Append( @"document.getElementById( """ ) ; sb.AppendFormat( @"{0}"" ).value =""{1}"" ;", outputTextBox.ClientID, s ) ; sb.AppendFormat( "{0}</script>{0}", Environment.NewLine ) ; Page.RegisterStartupScript( "populateTB", sb.ToString() ) ; }