(StringComparer.OrdinalIgnoreCase) { "script", "style", "svg", "img" };
-
- var parser = new HtmlParser();
- var doc = parser.Parse(source);
-
- var treeWalker = doc.CreateTreeWalker(doc.Body, FilterSettings.Text);
-
- var sb = new StringBuilder();
-
- var node = treeWalker.ToNext();
- while (node != null)
- {
- if (!ignoreTags.Contains(node.Parent.NodeName))
- {
- var text = node.TextContent;
- if (text.HasValue())
- {
- sb.AppendLine(text);
- }
- }
-
- node = treeWalker.ToNext();
- }
-
- return sb.ToString().HtmlDecode();
+ return HtmlUtils.StripTags(source).Trim().HtmlDecode();
}
///
@@ -637,30 +611,29 @@ public static string[] SplitSafe(this string value, string separator)
if (string.IsNullOrEmpty(value))
return new string[0];
- // do not use separator.IsEmpty() here because whitespace like " " is a valid separator.
+ // Do not use separator.IsEmpty() here because whitespace like " " is a valid separator.
// an empty separator "" returns array with value.
if (separator == null)
{
- separator = "|";
-
- if (value.IndexOf(separator) < 0)
+ for (var i = 0; i < value.Length; i++)
{
- if (value.IndexOf(';') > -1)
- {
- separator = ";";
- }
- else if (value.IndexOf(',') > -1)
+ var c = value[i];
+ if (c == ';' || c == ',' || c == '|')
{
- separator = ",";
+ return value.Split(new char[] { c }, StringSplitOptions.RemoveEmptyEntries);
}
- else if (value.IndexOf(Environment.NewLine) > -1)
+ if (c == '\r' && (i + 1) < value.Length & value[i + 1] == '\n')
{
- separator = Environment.NewLine;
+ return value.GetLines(false, true).ToArray();
}
}
- }
- return value.Split(new string[] { separator }, StringSplitOptions.RemoveEmptyEntries);
+ return new string[] { value };
+ }
+ else
+ {
+ return value.Split(new string[] { separator }, StringSplitOptions.RemoveEmptyEntries);
+ }
}
/// Splits a string into two strings
@@ -1113,11 +1086,8 @@ public static string ReplaceCsvChars(this string s)
[DebuggerStepThrough]
public static string HighlightKeywords(this string input, string keywords, string preMatch = "", string postMatch = "")
{
- if (preMatch == null)
- throw new ArgumentNullException(nameof(preMatch));
-
- if (postMatch == null)
- throw new ArgumentNullException(nameof(postMatch));
+ Guard.NotNull(preMatch, nameof(preMatch));
+ Guard.NotNull(postMatch, nameof(postMatch));
if (string.IsNullOrWhiteSpace(input) || string.IsNullOrWhiteSpace(keywords))
{
@@ -1133,7 +1103,7 @@ public static string HighlightKeywords(this string input, string keywords, strin
if (!string.IsNullOrWhiteSpace(pattern))
{
var rg = new Regex(pattern, RegexOptions.IgnoreCase);
- input = rg.Replace(input, m => preMatch + m.Value + postMatch);
+ input = rg.Replace(input, m => preMatch + m.Value.EmptyNull().HtmlEncode() + postMatch);
}
return input;
diff --git a/src/Libraries/SmartStore.Core/Fakes/FakeHttpContext.cs b/src/Libraries/SmartStore.Core/Fakes/FakeHttpContext.cs
index 4a024630cc..68302e9a61 100644
--- a/src/Libraries/SmartStore.Core/Fakes/FakeHttpContext.cs
+++ b/src/Libraries/SmartStore.Core/Fakes/FakeHttpContext.cs
@@ -66,6 +66,8 @@ public FakeHttpContext(string relativeUrl,
_serverVariables = serverVariables;
_items = new Dictionary();
+
+ Handler = new FakeHttpHandler();
}
public override IHttpHandler Handler { get; set; }
diff --git a/src/Libraries/SmartStore.Core/Fakes/FakeHttpHandler.cs b/src/Libraries/SmartStore.Core/Fakes/FakeHttpHandler.cs
new file mode 100644
index 0000000000..ea0839801a
--- /dev/null
+++ b/src/Libraries/SmartStore.Core/Fakes/FakeHttpHandler.cs
@@ -0,0 +1,15 @@
+using System;
+using System.Web;
+
+namespace SmartStore.Core.Fakes
+{
+ public class FakeHttpHandler : IHttpHandler
+ {
+ public bool IsReusable => true;
+
+ public void ProcessRequest(HttpContext context)
+ {
+ throw new NotImplementedException();
+ }
+ }
+}
diff --git a/src/Libraries/SmartStore.Core/Fakes/FakeHttpRequest.cs b/src/Libraries/SmartStore.Core/Fakes/FakeHttpRequest.cs
index 5238183265..ee5ecc7928 100644
--- a/src/Libraries/SmartStore.Core/Fakes/FakeHttpRequest.cs
+++ b/src/Libraries/SmartStore.Core/Fakes/FakeHttpRequest.cs
@@ -115,8 +115,8 @@ public override string ApplicationPath
{
get
{
- //we know that relative paths always start with ~/
- //ApplicationPath should start with /
+ // We know that relative paths always start with ~/
+ // ApplicationPath should start with /
if (_relativeUrl != null && _relativeUrl.StartsWith("~/"))
return _relativeUrl.Remove(0, 1);
return null;
@@ -137,10 +137,11 @@ public override string UserHostAddress
}
public override string RawUrl => this.ApplicationPath;
- public override bool IsSecureConnection => false;
+ public override bool IsSecureConnection => _url?.Scheme?.EmptyNull().StartsWith("https", StringComparison.OrdinalIgnoreCase) == true;
public override bool IsAuthenticated => false;
public override string[] UserLanguages => new string[] { };
public override string UserAgent => "SmartStore.NET";
+ public override bool IsLocal => false;
public override RequestContext RequestContext
{
diff --git a/src/Libraries/SmartStore.Core/Html/BBCodeHelper.cs b/src/Libraries/SmartStore.Core/Html/BBCodeHelper.cs
index dea33ad5f2..b4e9c92eb0 100644
--- a/src/Libraries/SmartStore.Core/Html/BBCodeHelper.cs
+++ b/src/Libraries/SmartStore.Core/Html/BBCodeHelper.cs
@@ -4,21 +4,15 @@
namespace SmartStore.Core.Html
{
- ///
- /// Represents a BBCode helper
- ///
public partial class BBCodeHelper
{
- #region Fields
private static readonly Regex regexBold = new Regex(@"\[b\](.+?)\[/b\]", RegexOptions.Compiled | RegexOptions.IgnoreCase);
private static readonly Regex regexItalic = new Regex(@"\[i\](.+?)\[/i\]", RegexOptions.Compiled | RegexOptions.IgnoreCase);
private static readonly Regex regexUnderLine = new Regex(@"\[u\](.+?)\[/u\]", RegexOptions.Compiled | RegexOptions.IgnoreCase);
private static readonly Regex regexUrl1 = new Regex(@"\[url\=([^\]]+)\]([^\]]+)\[/url\]", RegexOptions.Compiled | RegexOptions.IgnoreCase);
private static readonly Regex regexUrl2 = new Regex(@"\[url\](.+?)\[/url\]", RegexOptions.Compiled | RegexOptions.IgnoreCase);
private static readonly Regex regexQuote = new Regex(@"\[quote(=.+?)?\](.+?)\[/quote\]", RegexOptions.Compiled | RegexOptions.IgnoreCase);
- #endregion
- #region Methods
///
/// Formats the text
///
@@ -30,8 +24,14 @@ public partial class BBCodeHelper
/// A value indicating whether to replace Code
/// A value indicating whether to replace Quote
/// Formatted text
- public static string FormatText(string text, bool replaceBold, bool replaceItalic,
- bool replaceUnderline, bool replaceUrl, bool replaceCode, bool replaceQuote)
+ public static string ToHtml(
+ string text,
+ bool replaceBold = true,
+ bool replaceItalic = true,
+ bool replaceUnderline = true,
+ bool replaceUrl = true,
+ bool replaceCode = true,
+ bool replaceQuote = true)
{
if (String.IsNullOrEmpty(text))
return string.Empty;
@@ -115,6 +115,5 @@ public static string RemoveQuotes(string str)
str = Regex.Replace(str, @"\[/quote\]", String.Empty, RegexOptions.Compiled | RegexOptions.IgnoreCase);
return str;
}
- #endregion
}
}
diff --git a/src/Libraries/SmartStore.Core/Html/HtmlUtils.cs b/src/Libraries/SmartStore.Core/Html/HtmlUtils.cs
index 3e645dcc1f..f3239a1b15 100644
--- a/src/Libraries/SmartStore.Core/Html/HtmlUtils.cs
+++ b/src/Libraries/SmartStore.Core/Html/HtmlUtils.cs
@@ -6,6 +6,10 @@
using AngleSharp;
using AngleSharp.Parser.Html;
using AngleSharp.Parser.Css;
+using System.Collections.Generic;
+using AngleSharp.Dom;
+using AngleSharp.Dom.Html;
+using Ganss.XSS;
namespace SmartStore.Core.Html
{
@@ -14,133 +18,127 @@ namespace SmartStore.Core.Html
///
public partial class HtmlUtils
{
- private readonly static Regex _paragraphStartRegex = new Regex("", RegexOptions.IgnoreCase);
+ private readonly static Regex _paragraphStartRegex = new Regex("
", RegexOptions.IgnoreCase);
private readonly static Regex _paragraphEndRegex = new Regex("
", RegexOptions.IgnoreCase);
- //private static Regex ampRegex = new Regex("&(?!(?:#[0-9]{2,4};|[a-z0-9]+;))", RegexOptions.Compiled | RegexOptions.IgnoreCase);
+ //private static Regex ampRegex = new Regex("&(?!(?:#[0-9]{2,4};|[a-z0-9]+;))", RegexOptions.Compiled | RegexOptions.IgnoreCase);
- private static string EnsureOnlyAllowedHtml(string text)
- {
- if (String.IsNullOrEmpty(text))
- return string.Empty;
+ ///
+ /// Formats the text
+ ///
+ /// Text
+ /// A value indicating whether to strip tags
+ /// A value indicating whether HTML is allowed
+ /// A value indicating whether HTML is allowed
+ /// A value indicating whether BBCode is allowed
+ /// A value indicating whether to resolve links
+ /// A value indicating whether to add "noFollow" tag
+ /// Formatted text
+ [Obsolete("Use specific formatter methods instead, e.g. StripTags(), SanitizeHtml() etc.")]
+ public static string FormatText(
+ string text,
+ bool stripTags,
+ bool convertPlainTextToHtml,
+ bool allowHtml,
+ bool allowBBCode,
+ bool resolveLinks,
+ bool addNoFollowTag)
+ {
- string allowedTags = "br,hr,b,i,u,a,div,ol,ul,li,dl,dt,dd,blockquote,img,span,p,em,strong,font,pre,h1,h2,h3,h4,h5,h6,address,cite";
+ if (String.IsNullOrEmpty(text))
+ return string.Empty;
- var m = Regex.Matches(text, "<.*?>", RegexOptions.IgnoreCase);
- for (int i = m.Count - 1; i >= 0; i--)
- {
- string tag = text.Substring(m[i].Index + 1, m[i].Length - 1).Trim().ToLower();
+ try
+ {
+ if (stripTags)
+ {
+ text = StripTags(text);
+ }
- if (!IsValidTag(tag, allowedTags))
- {
- text = text.Remove(m[i].Index, m[i].Length);
- }
- }
+ if (allowHtml)
+ {
+ text = SanitizeHtml(text);
+ }
+ else
+ {
+ text = HttpUtility.HtmlEncode(text);
+ }
- return text;
- }
+ if (convertPlainTextToHtml)
+ {
+ text = ConvertPlainTextToHtml(text);
+ }
- private static bool IsValidTag(string tag, string tags)
- {
- string[] allowedTags = tags.Split(',');
- if (tag.IndexOf("javascript", StringComparison.OrdinalIgnoreCase) >= 0) return false;
- if (tag.IndexOf("vbscript", StringComparison.OrdinalIgnoreCase) >= 0) return false;
- if (tag.IndexOf("onclick", StringComparison.OrdinalIgnoreCase) >= 0) return false;
+ if (allowBBCode)
+ {
+ text = BBCodeHelper.ToHtml(text, true, true, true, true, true, true);
+ }
- var endchars = new char[] { ' ', '>', '/', '\t' };
+ if (resolveLinks)
+ {
+ text = ResolveLinksHelper.FormatText(text);
+ }
- int pos = tag.IndexOfAny(endchars, 1);
- if (pos > 0) tag = tag.Substring(0, pos);
- if (tag[0] == '/') tag = tag.Substring(1);
+ if (addNoFollowTag)
+ {
+ //add noFollow tag. not implemented
+ }
+ }
+ catch (Exception exc)
+ {
+ text = string.Format("Text cannot be formatted. Error: {0}", exc.Message);
+ }
- return allowedTags.Any(aTag => tag == aTag);
- }
+ return text;
+ }
- ///
- /// Formats the text
- ///
- /// Text
- /// A value indicating whether to strip tags
- /// A value indicating whether HTML is allowed
- /// A value indicating whether HTML is allowed
- /// A value indicating whether BBCode is allowed
- /// A value indicating whether to resolve links
- /// A value indicating whether to add "noFollow" tag
- /// Formatted text
- public static string FormatText(
- string text,
- bool stripTags,
- bool convertPlainTextToHtml,
- bool allowHtml,
- bool allowBBCode,
- bool resolveLinks,
- bool addNoFollowTag)
+ public static string SanitizeHtml(string html, bool isFragment = true)
{
-
- if (String.IsNullOrEmpty(text))
+ if (string.IsNullOrEmpty(html))
return string.Empty;
- try
- {
- if (stripTags)
- {
- text = StripTags(text);
- }
-
- if (allowHtml)
- {
- text = EnsureOnlyAllowedHtml(text);
- }
- else
- {
- text = HttpUtility.HtmlEncode(text);
- }
-
- if (convertPlainTextToHtml)
- {
- text = ConvertPlainTextToHtml(text);
- }
-
- if (allowBBCode)
- {
- text = BBCodeHelper.FormatText(text, true, true, true, true, true, true);
- }
+ var sanitizer = new HtmlSanitizer();
- if (resolveLinks)
- {
- text = ResolveLinksHelper.FormatText(text);
- }
-
- if (addNoFollowTag)
- {
- //add noFollow tag. not implemented
- }
- }
- catch (Exception exc)
- {
- text = string.Format("Text cannot be formatted. Error: {0}", exc.Message);
- }
- return text;
+ if (isFragment)
+ {
+ return sanitizer.Sanitize(html);
+ }
+ else
+ {
+ return sanitizer.SanitizeDocument(html);
+ }
}
///
/// Strips tags
///
- /// Text
+ /// Text
/// Formatted text
- public static string StripTags(string text)
+ public static string StripTags(string html)
{
- if (String.IsNullOrEmpty(text))
- return string.Empty;
+ if (html.IsEmpty())
+ return string.Empty;
- text = Regex.Replace(text, @"(>)(\r|\n)*(<)", "><");
- text = Regex.Replace(text, "(<[^>]*>)([^<]*)", "$2");
- text = Regex.Replace(text, "(&#x?[0-9]{2,4};|"|&| |<|>|€|©|®|‰|‡|†|‹|›|„|”|“|‚|’|‘|—|–||||| | | |˜|ˆ|Ÿ|š|Š)", "@");
+ var ignoreTags = new HashSet(StringComparer.OrdinalIgnoreCase) { "script", "style", "svg", "img" };
+ var parser = new HtmlParser();
+ var doc = parser.Parse(html);
- return text;
- }
+ List removeElements = new List();
+
+ foreach (var ignoreTag in ignoreTags)
+ {
+ removeElements.AddRange(doc.QuerySelectorAll(ignoreTag));
+ }
+
+ foreach (var el in removeElements)
+ {
+ el.Remove();
+ }
+
+ return doc.Body.TextContent;
+ }
///
- /// replace anchor text (remove a tag from the following url Name and output only the string "Name")
+ /// Replace anchor text (remove a tag from the following url Name and output only the string "Name")
///
/// Text
/// Text
@@ -160,7 +158,7 @@ public static string ReplaceAnchorTags(string text)
/// Formatted text
public static string ConvertPlainTextToHtml(string text)
{
- if (String.IsNullOrEmpty(text))
+ if (string.IsNullOrEmpty(text))
return string.Empty;
text = text.Replace("\r\n", "
");
diff --git a/src/Libraries/SmartStore.Core/Html/ResolveLinksHelper.cs b/src/Libraries/SmartStore.Core/Html/ResolveLinksHelper.cs
index c58f9540ba..afa070448f 100644
--- a/src/Libraries/SmartStore.Core/Html/ResolveLinksHelper.cs
+++ b/src/Libraries/SmartStore.Core/Html/ResolveLinksHelper.cs
@@ -10,16 +10,12 @@ namespace SmartStore.Core.Html
/// 
+
+
+
+
+
+ 
+ 
+ 
+ 
+ 
+
+ Try Online ∙
+ Docs ∙
+ Forum ∙
+ Marketplace ∙
+ Translations