public DefaultJavaScriptEncoder(TextEncoderSettings filter) { if (filter == null) { throw new ArgumentNullException(nameof(filter)); } _allowedCharacters = filter.GetAllowedCharacters(); // Forbid codepoints which aren't mapped to characters or which are otherwise always disallowed // (includes categories Cc, Cs, Co, Cn, Zs [except U+0020 SPACE], Zl, Zp) _allowedCharacters.ForbidUndefinedCharacters(); // Forbid characters that are special in HTML. // Even though this is a not HTML encoder, // it's unfortunately common for developers to // forget to HTML-encode a string once it has been JS-encoded, // so this offers extra protection. DefaultHtmlEncoder.ForbidHtmlCharacters(_allowedCharacters); // '\' (U+005C REVERSE SOLIDUS) must always be escaped in Javascript / ECMAScript / JSON. // '/' (U+002F SOLIDUS) is not Javascript / ECMAScript / JSON-sensitive so doesn't need to be escaped. _allowedCharacters.ForbidCharacter('\\'); // '`' (U+0060 GRAVE ACCENT) is ECMAScript-sensitive (see ECMA-262). _allowedCharacters.ForbidCharacter('`'); for (int i = 0; i < _asciiNeedsEscaping.Length; i++) { _asciiNeedsEscaping[i] = WillEncode(i) ? 1 : -1; } }
public DefaultJavaScriptEncoder(TextEncoderSettings filter) { if (filter == null) { throw new ArgumentNullException(nameof(filter)); } _allowedCharacters = filter.GetAllowedCharacters(); // Forbid codepoints which aren't mapped to characters or which are otherwise always disallowed // (includes categories Cc, Cs, Co, Cn, Zs [except U+0020 SPACE], Zl, Zp) _allowedCharacters.ForbidUndefinedCharacters(); // Forbid characters that are special in HTML. // Even though this is a not HTML encoder, // it's unfortunately common for developers to // forget to HTML-encode a string once it has been JS-encoded, // so this offers extra protection. DefaultHtmlEncoder.ForbidHtmlCharacters(_allowedCharacters); _allowedCharacters.ForbidCharacter('\\'); _allowedCharacters.ForbidCharacter('/'); // Forbid GRAVE ACCENT \u0060 character. _allowedCharacters.ForbidCharacter('`'); }
public DefaultJavaScriptEncoder(CodePointFilter filter) { _allowedCharsBitmap = filter.GetAllowedCharsBitmap(); // Forbid codepoints which aren't mapped to characters or which are otherwise always disallowed // (includes categories Cc, Cs, Co, Cn, Zs [except U+0020 SPACE], Zl, Zp) _allowedCharsBitmap.ForbidUndefinedCharacters(); // Forbid characters that are special in HTML. // Even though this is a not HTML encoder, // it's unfortunately common for developers to // forget to HTML-encode a string once it has been JS-encoded, // so this offers extra protection. DefaultHtmlEncoder.ForbidHtmlCharacters(_allowedCharsBitmap); _allowedCharsBitmap.ForbidCharacter('\\'); _allowedCharsBitmap.ForbidCharacter('/'); }
private DefaultJavaScriptEncoderBasicLatin() { var filter = new TextEncoderSettings(UnicodeRanges.BasicLatin); AllowedCharactersBitmap allowedCharacters = filter.GetAllowedCharacters(); // Forbid codepoints which aren't mapped to characters or which are otherwise always disallowed // (includes categories Cc, Cs, Co, Cn, Zs [except U+0020 SPACE], Zl, Zp) allowedCharacters.ForbidUndefinedCharacters(); // Forbid characters that are special in HTML. // Even though this is a not HTML encoder, // it's unfortunately common for developers to // forget to HTML-encode a string once it has been JS-encoded, // so this offers extra protection. DefaultHtmlEncoder.ForbidHtmlCharacters(allowedCharacters); // '\' (U+005C REVERSE SOLIDUS) must always be escaped in Javascript / ECMAScript / JSON. // '/' (U+002F SOLIDUS) is not Javascript / ECMAScript / JSON-sensitive so doesn't need to be escaped. allowedCharacters.ForbidCharacter('\\'); // '`' (U+0060 GRAVE ACCENT) is ECMAScript-sensitive (see ECMA-262). allowedCharacters.ForbidCharacter('`'); #if DEBUG // Verify and ensure that the AllowList bit map matches the set of allowed characters using AllowedCharactersBitmap for (int i = 0; i < AllowList.Length; i++) { char ch = (char)i; Debug.Assert((allowedCharacters.IsCharacterAllowed(ch) ? 1 : 0) == AllowList[ch]); Debug.Assert(allowedCharacters.IsCharacterAllowed(ch) == !NeedsEscaping(ch)); } for (int i = AllowList.Length; i <= char.MaxValue; i++) { char ch = (char)i; Debug.Assert(!allowedCharacters.IsCharacterAllowed(ch)); Debug.Assert(NeedsEscaping(ch)); } #endif }
public HtmlEncoder(CodePointFilter filter) { _encoder = new System.Text.Encodings.Web.DefaultHtmlEncoder(filter); }
public HtmlEncoder() { _encoder = System.Text.Encodings.Web.DefaultHtmlEncoder.Singleton; }
public DefaultUrlEncoder(TextEncoderSettings filter) { if (filter == null) { throw new ArgumentNullException(nameof(filter)); } _allowedCharacters = filter.GetAllowedCharacters(); // Forbid codepoints which aren't mapped to characters or which are otherwise always disallowed // (includes categories Cc, Cs, Co, Cn, Zs [except U+0020 SPACE], Zl, Zp) _allowedCharacters.ForbidUndefinedCharacters(); // Forbid characters that are special in HTML. // Even though this is a not HTML encoder, // it's unfortunately common for developers to // forget to HTML-encode a string once it has been URL-encoded, // so this offers extra protection. DefaultHtmlEncoder.ForbidHtmlCharacters(_allowedCharacters); // Per RFC 3987, Sec. 2.2, we want encodings that are safe for // four particular components: 'isegment', 'ipath-noscheme', // 'iquery', and 'ifragment'. The relevant definitions are below. // // ipath-noscheme = isegment-nz-nc *( "/" isegment ) // // isegment = *ipchar // // isegment-nz-nc = 1*( iunreserved / pct-encoded / sub-delims // / "@" ) // ; non-zero-length segment without any colon ":" // // ipchar = iunreserved / pct-encoded / sub-delims / ":" // / "@" // // iquery = *( ipchar / iprivate / "/" / "?" ) // // ifragment = *( ipchar / "/" / "?" ) // // iunreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" / ucschar // // ucschar = %xA0-D7FF / %xF900-FDCF / %xFDF0-FFEF // / %x10000-1FFFD / %x20000-2FFFD / %x30000-3FFFD // / %x40000-4FFFD / %x50000-5FFFD / %x60000-6FFFD // / %x70000-7FFFD / %x80000-8FFFD / %x90000-9FFFD // / %xA0000-AFFFD / %xB0000-BFFFD / %xC0000-CFFFD // / %xD0000-DFFFD / %xE1000-EFFFD // // pct-encoded = "%" HEXDIG HEXDIG // // sub-delims = "!" / "$" / "&" / "'" / "(" / ")" // / "*" / "+" / "," / ";" / "=" // // The only common characters between these four components are the // intersection of 'isegment-nz-nc' and 'ipchar', which is really // just 'isegment-nz-nc' (colons forbidden). // // From this list, the base encoder already forbids "&", "'", "+", // and we'll additionally forbid "=" since it has special meaning // in x-www-form-urlencoded representations. // // This means that the full list of allowed characters from the // Basic Latin set is: // ALPHA / DIGIT / "-" / "." / "_" / "~" / "!" / "$" / "(" / ")" / "*" / "," / ";" / "@" const string forbiddenChars = @" #%/:=?[\]^`{|}"; // chars from Basic Latin which aren't already disallowed by the base encoder foreach (char character in forbiddenChars) { _allowedCharacters.ForbidCharacter(character); } // Specials (U+FFF0 .. U+FFFF) are forbidden by the definition of 'ucschar' above for (int i = 0; i < 16; i++) { _allowedCharacters.ForbidCharacter((char)(0xFFF0 | i)); } }
public HtmlEncoder(TextEncoderSettings filter) { _encoder = new System.Text.Encodings.Web.DefaultHtmlEncoder(filter); }
public HtmlEncoder(CodePointFilter filter) { _encoder = new System.Text.Encodings.Web.DefaultHtmlEncoder(filter); }
public HtmlEncoder() { _encoder = System.Text.Encodings.Web.DefaultHtmlEncoder.Singleton; }
public HtmlEncoder(TextEncoderSettings filter) { _encoder = new System.Text.Encodings.Web.DefaultHtmlEncoder(filter); }