Databases
StackOverflow2013
Postsdbo
POSanitizing Input with JsonConvert.SerializeObject in MVC4?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSanitizing Input with JsonConvert.SerializeObject in MVC4?
    primarykey
    data
    text
    <p>Long story short, I'm trying to get the output from JsonConvert.SerializeObject to be sanitized without having to modify the contents of the saved data.</p> <p>I'm working on an app that has the following markup in the view: </p> <pre><code> &lt;textarea data-bind="value: aboutMe"&gt;&lt;/textarea&gt; </code></pre> <p>If I save the following text, I run into problems: </p> <pre><code> &lt;script type="text/javascript"&gt;alert("hey")&lt;/script&gt; </code></pre> <p>The error I get in FF: </p> <p><img src="https://i.stack.imgur.com/gJtGc.png" alt="enter image description here"></p> <p>The relevant part of the offending rendered text:</p> <blockquote> <p>$(document).ready(ko.applyBindings(new MyProfileVm({"profileUsername":"admin","username":"Admin","aboutMe":"alert(\"hey\")","title":"Here's a short self-bio! :)","thumbnail":"<a href="https://i.imgur.com/H1HYxU9.jpg" rel="nofollow noreferrer">https://i.imgur.com/H1HYxU9.jpg</a>","locationZip":"22182","locationName":"Vienna, VA"</p> </blockquote> <p>And finally - at the bottom of my view: </p> <pre><code>&lt;script type="text/javascript"&gt; $(document).ready(ko.applyBindings(new MyProfileVm(@Html.Raw(JsonConvert.SerializeObject(Model, new JsonSerializerSettings() { ContractResolver = new CamelCasePropertyNamesContractResolver() }))))); &lt;/script&gt; </code></pre> <p>Here, I'm passing the model that I get from the MVC controller into the js ViewModel for knockout to map into observable data. The Raw encoding seems to be the problem, but I'm not sure how to go about handling it.</p> <p>To be clear, I'm getting data from the server, and outputting it to the client, which is mucking up the JSON/KO combo. </p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USSB2055
    1. USSB2055
    plurals
    1. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POSanitizing Input with JsonConvert.SerializeObject in MVC4?
      1. This table or related slice is empty.
      1. VTApproveEditSuggestion
    2. VO
      singulars
      1. POSanitizing Input with JsonConvert.SerializeObject in MVC4?
      1. USSB2055
      1. VTBountyStart
    3. VO
      singulars
      1. POSanitizing Input with JsonConvert.SerializeObject in MVC4?
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload