public void Nullable()
{
var obj = ModelSanitizer.Sanitize(new TestNullable());
Assert.That(obj.Value, Is.EqualTo(100));
Assert.That(obj.Null, Is.Null);
}
public void EnumUndefined()
{
var value = (TestEnum)999;
value = ModelSanitizer.Sanitize(value);
Assert.That(value, Is.EqualTo(default(TestEnum)));
}
public void NullableValue()
{
var value = 100 as int?;
value = ModelSanitizer.Sanitize(value);
Assert.That(value, Is.EqualTo(100));
}
public void EnumFlagsUndefined()
{
var value = TestEnumFlags.None | TestEnumFlags.One | TestEnumFlags.Three | (TestEnumFlags)(1 << 7);
value = ModelSanitizer.Sanitize(value);
Assert.That(value, Is.EqualTo(TestEnumFlags.One | TestEnumFlags.Three));
}
public void EnumFlagsNone()
{
var value = TestEnumFlags.None;
value = ModelSanitizer.Sanitize(value);
Assert.That(value, Is.EqualTo(TestEnumFlags.None));
}
public void EnumValid()
{
var value = TestEnum.Two;
value = ModelSanitizer.Sanitize(value);
Assert.That(value, Is.EqualTo(TestEnum.Two));
}
public override T Sanitize(T value)
{
if (_sanitizer == null)
{
_sanitizer = ModelSanitizer.GetSanitizer <T>();
}
return(_sanitizer.Sanitize(value));
}
public async Task BindModelAsync(ModelBindingContext bindingContext)
{
await _binder.BindModelAsync(bindingContext);
if (bindingContext.Result.IsModelSet)
{
bindingContext.Result = ModelBindingResult.Success(ModelSanitizer.Sanitize(bindingContext.Result.Model));
}
}
public void IgnoreStruct()
{
var test = new TestStruct
{
String = " "
};
test = ModelSanitizer.Sanitize(test);
Assert.That(test.String, Is.EqualTo(" "));
}
public Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
{
var reason = ModelSanitizer.Sanitize(context.HttpContext.Request.Query["reason"].ToString());
if (reason != null && reason.Length >= MinReasonLength)
{
return(next());
}
context.Result = ResultUtilities.BadRequest("A valid reason must be provided for this action.");
return(Task.CompletedTask);
}
public CastingSanitizer()
{
var sanitizer = ModelSanitizer.GetSanitizer <TInner>();
var sanitizerMethod = sanitizer.GetType().GetMethod(nameof(Sanitize));
var param = Expression.Parameter(typeof(TOuter), "value");
// ReSharper disable once AssignNullToNotNullAttribute
var result = Expression.Convert(Expression.Call(Expression.Constant(sanitizer), sanitizerMethod, Expression.Convert(param, typeof(TInner))), typeof(TOuter));
var lambda = Expression.Lambda <Func <TOuter, TOuter> >(result, param);
ModelSanitizer.OnExpressionBuilt?.Invoke(lambda);
_sanitize = lambda.CompileFast();
}
public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
{
var validator = context.HttpContext.RequestServices.GetService <IRecaptchaValidator>();
var value = ModelSanitizer.Sanitize(context.HttpContext.Request.Query["recaptcha"].ToString());
if (await validator.TryValidateAsync(value, context.HttpContext.RequestAborted))
{
await next();
}
else
{
context.Result = ResultUtilities.BadRequest("Could not verify reCAPTCHA token.");
}
}
public void StringArray()
{
var list = new[]
{
"",
"test",
" test 2",
null
};
list = ModelSanitizer.Sanitize(list);
Assert.That(list, Is.EqualTo(new[]
{
"test",
"test 2"
}));
}
public void StringCollection()
{
var col = new Collection <string>
{
"",
"test",
" test 2",
null
};
col = ModelSanitizer.Sanitize(col);
Assert.That(col, Is.EqualTo(new Collection <string>
{
"test",
"test 2"
}));
}
public void StringDictionary()
{
var dict = new Dictionary <string, string>
{
[""] = "gone",
[" "] = "gone",
["valid"] = " cool ",
[" valid "] = "overridden",
["gone"] = null
};
dict = ModelSanitizer.Sanitize(dict);
Assert.That(dict, Is.EqualTo(new Dictionary <string, string>
{
["valid"] = "cool"
}));
}
public void ComplexType()
{
var obj = new TestComplexType();
ModelSanitizer.Sanitize(obj);
Assert.That(obj, Is.Not.Null);
Assert.That(obj.String, Is.EqualTo("sanitize me"));
Assert.That(obj.IgnoreMe, Is.EqualTo(" ignored "));
Assert.That(obj.StringSet, Is.EqualTo(new SortedSet <string> {
"hello"
}));
Assert.That(obj.Nested, Has.Exactly(2).Items);
Assert.That(obj.Nested[0].Name, Is.EqualTo("one"));
Assert.That(obj.Nested[0].Dict, Is.Null);
Assert.That(obj.Nested[1].Name, Is.EqualTo("two"));
Assert.That(obj.Nested[1].Dict, Has.Exactly(1).Items);
Assert.That(obj.Nested[1].Dict["three"].Name, Is.EqualTo("three"));
}
/// <summary>
/// Formats a tag string.
/// </summary>
public static string Format(string tag)
{
if (string.IsNullOrEmpty(tag))
{
return(null);
}
// lowercase
tag = tag.ToLowerInvariant();
// remove diacritics
tag = RemoveDiacritics(tag);
// remove non-ascii
tag = _nonAsciiRegex.Replace(tag, "");
// space-separated
tag = tag.Replace('_', ' ');
return(ModelSanitizer.Sanitize(tag));
}
public Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
{
switch (context.HttpContext.Request.Method)
{
case "POST":
case "PUT":
var query = ModelSanitizer.Sanitize(context.HttpContext.Request.Query["validate"].ToString());
if (query != null && (!bool.TryParse(query, out var x) || x)) // specified and not "false"
{
// at this point in an action filter, model is already validated, so we will simply short-circuit.
// we always with 422 even if there are no validation problems.
var problems = Array.Empty <ValidationProblem>();
context.Result = ResultUtilities.UnprocessableEntity(problems);
return(Task.CompletedTask);
}
break;
}
return(next());
}
public void NullableNull()
{
var value = ModelSanitizer.Sanitize(null as int?);
Assert.That(value, Is.Null);
}
public void EmptyString()
=> Assert.That(ModelSanitizer.Sanitize(""), Is.Null);
public void TrimString()
=> Assert.That(ModelSanitizer.Sanitize(" f "), Is.EqualTo("f"));
public void WhiteSpaceString()
=> Assert.That(ModelSanitizer.Sanitize(" "), Is.Null);
public void ReadOnly()
{
var obj = ModelSanitizer.Sanitize(new TestReadOnly());
Assert.That(obj.DontChange, Is.EqualTo(" no "));
}
public void NullCharString()
=> Assert.That(ModelSanitizer.Sanitize($"test{(char) 0}"), Is.EqualTo("test"));
public void InvalidSpaces()
=> Assert.That(ModelSanitizer.Sanitize(" "), Is.Null); // there is zws in this string
