Server.HtmlEncode fails with "Server is undefined"

[teddysnips]

In my application I need to allow users to cut 'n' paste stuff from
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:

....
<asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:textbox>

....

<script language="vb" runat=server>
Public Sub ReplaceScriptCode()
txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
End Sub
</script>

The app. barfs, telling me that "Server is undefined". Thoughts?

Thanks

Edward

 

[=?ISO-8859-1?Q?G=F6ran_Andersson?=]

In my application I need to allow users to cut 'n' paste stuff from
various sources, some of which might include dodgy characters such as
"<". Natch, IE interprets these as potentially dangerous and provides
a mechanism to encode/decode them. However I can't seem to get it to
work:

...
<asp:textbox id=txtDescription style="Z-INDEX: 102; LEFT: 111px;
POSITION: absolute; TOP: 124px" tabIndex=29 runat="server"
onblur="return ReplaceScriptCode()" Width="553px" Height="52px"
CssClass="STANDARD" Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:textbox>

...

<script language="vb" runat=server>
Public Sub ReplaceScriptCode()
txtDescription.Text = Server.HtmlEncode(txtDescription.Text)
End Sub
</script>

The app. barfs, telling me that "Server is undefined". Thoughts?

Thanks

Edward

You are mixing server code and client code. The code in the onblur event
doesn't call the VB subroutine that you have put in the server code, it
calls the client side function with the same name.

As you don't get the error message that ReplaceScriptCode is undefined,
I assume that you also have a Javascript or VBScript function with that
name?

If you have put the same code in that function as in your VB server side
subroutine, that will obviously not work, as there is no Server object
on the client side.

What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.

 

[Guest]

Edward

I think your problem is that the OnBlur event, which is calling your
ReplaceScriptCode is a client side event, whereas the Server object is server
side. The code works fine if executed from from code behind:

<asp:TextBox ID="txtDescription" Style="z-index: 102; left:
111px; position: absolute;
top: 124px" TabIndex="29" runat="server" onblur="return
ReplaceScriptCode()"
Width="553px" Height="52px" CssClass="STANDARD"
Font-Names="Arial" Font-Size="8pt"
TextMode="MultiLine"></asp:TextBox>

<script language="vb" runat="server">
Protected Overrides Sub OnLoad(ByVal e As System.EventArgs)
MyBase.OnLoad(e)

txtDescription.Text =
Server.HtmlEncode(txtDescription.Text)
End Sub
</script>

<asp:Button ID="Button1" runat="server" Text="Button" /></div>

Just hit the button to test it.

Hope this helps

Tom

 

[teddysnips]

(e-mail address removed) wrote: [...]
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.

As you say. The problem comes when the user tries to post the text
(dumb of me, I know, I should have mentioned that).

The user wants to be able to paste stuff into text boxes which is then
sent to the server for processing (generally, storage in a database
and later retrieval).

I don't want to remove validation at page level - in fact I doubt the
clients would let me. I rolled my own client-side jscript to strip
out markup code which was called from the OnBlur event, but I thought
I could improve on it using built-in functions.

In short, the requirement is:

ASP.NET with VB code behind.

User pastes stuff into an ASP TextBox

Presses "Save" button. Save button is asp:Button running server-side.

Remove/replace "dangerous" code with HtmlEncoded stuff and save to
database.

Thoughts?

Thanks,

Edward

 

[=?ISO-8859-1?Q?G=F6ran_Andersson?=]

(e-mail address removed) wrote: [...]
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.

As you say. The problem comes when the user tries to post the text
(dumb of me, I know, I should have mentioned that).

The user wants to be able to paste stuff into text boxes which is then
sent to the server for processing (generally, storage in a database
and later retrieval).

I don't want to remove validation at page level - in fact I doubt the
clients would let me.

That validation is not required, as long as you make sure that you treat
the data as unvalidated on the server side. That means that you never
put it on a page or use it in a database query without making sure that
it's properly encoded.

As the validation doesn't cover any possible circumstances, that's what
you already should be doing anyway.

Read up on cross site scripting and sql injections, so that you know how
these types of security leaks can be exploited.

I rolled my own client-side jscript to strip
out markup code which was called from the OnBlur event, but I thought
I could improve on it using built-in functions.

In short, the requirement is:

ASP.NET with VB code behind.

User pastes stuff into an ASP TextBox

Presses "Save" button. Save button is asp:Button running server-side.

Remove/replace "dangerous" code with HtmlEncoded stuff and save to
database.

Thoughts?

Storing it html encoded in the database served no purpose. Html code can
not harm the database. You just have to make sure it isn't put on a page
without being encoded.

 

[teddysnips]

(e-mail address removed) wrote: [...]
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.

[...]

Thanks for all your help so far - it really is appreciated.

I reaslise that there's no danger to the database from the text, or
markup code (actually, in the scenario at present, it's simply users
copying and pasting e-mail messages wholesale, including the reply
prefixes e.g. >> as seen above which are the main problem). I just
want to allow the users to copy and paste what they want and save this
text to the database without incurring "A potentially dangerous
Request.Form value ... " error. So it seems to make sense to htlm-
encode the text, whatever it is, save it, and then un-html-encode it
when the data is retrieved and displayed.

I can't be the only person in history to have encountered this problem
yet I can't seem to find any examples that satisfy my requirements. I
thought this page:

http://www.asp.net/faq/RequestValidation.aspx#5

had it, but I can't make it work.

Any further ideas before you lose patience completely?

Edward

 

[Mark Rae [MVP]]

Any further ideas before you lose patience completely?

Would something like this solve your problem:?
http://scriptasylum.com/tutorials/encdec/encode-decode.html

 

[=?ISO-8859-1?Q?G=F6ran_Andersson?=]

(e-mail address removed) wrote:
[...]
What is it that you are trying to do, really? There is nothing dangerous
about pasting markup code into a textbox. ASP.NET won't let you post
stuff that contains markup code to the server by default, but that is a
completely different thing, and has a completely different solution.

[...]

Thanks for all your help so far - it really is appreciated.

I reaslise that there's no danger to the database from the text, or
markup code (actually, in the scenario at present, it's simply users
copying and pasting e-mail messages wholesale, including the reply
prefixes e.g. >> as seen above which are the main problem). I just
want to allow the users to copy and paste what they want and save this
text to the database without incurring "A potentially dangerous
Request.Form value ... " error. So it seems to make sense to htlm-
encode the text, whatever it is, save it, and then un-html-encode it
when the data is retrieved and displayed.

No, that doesn't make sense. Encoding only makes sense if you use an
encoding that is relevant for where you put the data. Html-encoding data
that goes into the database and then decode it when you read it is a
total waste of time, space and code. It serves no purpose at all.

Also, as you were trying to encode the text on the client side, that
doesn't make it any safer. On the contrary, as you would later decode
this text that you can't safely say that you know is properly encoded,
you would instead open up the security hole that the validation is meant
to help prevent.

I can't be the only person in history to have encountered this problem

Of course not. I have handled the problem myself several times.

yet I can't seem to find any examples that satisfy my requirements. I
thought this page:

http://www.asp.net/faq/RequestValidation.aspx#5

had it, but I can't make it work.

Just pick that single property from that page and put in your @Page
directive. That turns the validation off.

Then you just handle the data as normal, just store it in the database
at it is. When you later put it on a page, make sure that it's properly
html encoded.