Html sanitized literal

Controls/SanitizedHtmlLiteral/.gitignore

@@ -0,0 +1,3 @@
+
+.fake
+.ionide

Controls/SanitizedHtmlLiteral/.vscode/launch.json

@@ -0,0 +1,36 @@
+{
+   // Use IntelliSense to find out which attributes exist for C# debugging
+   // Use hover for the description of the existing attributes
+   // For further information visit https://github.com/OmniSharp/omnisharp-vscode/blob/master/debugger-launchjson.md
+   "version": "0.2.0",
+   "configurations": [
+        {
+            "name": ".NET Core Launch (web)",
+            "type": "coreclr",
+            "request": "launch",
+            "preLaunchTask": "build",
+            // If you have changed target frameworks, make sure to update the program path.
+            "program": "${workspaceFolder}/src/DotVVM.Contrib.Samples/bin/Debug/netcoreapp2.0/DotVVM.Contrib.Samples.dll",
+            "args": [],
+            "cwd": "${workspaceFolder}/src/DotVVM.Contrib.Samples",
+            "stopAtEntry": false,
+            // Enable launching a web browser when ASP.NET Core starts. For more information: https://aka.ms/VSCode-CS-LaunchJson-WebBrowser
+            "serverReadyAction": {
+                "action": "openExternally",
+                "pattern": "^\\s*Now listening on:\\s+(https?://\\S+)"
+            },
+            "env": {
+                "ASPNETCORE_ENVIRONMENT": "Development"
+            },
+            "sourceFileMap": {
+                "/Views": "${workspaceFolder}/Views"
+            }
+        },
+        {
+            "name": ".NET Core Attach",
+            "type": "coreclr",
+            "request": "attach",
+            "processId": "${command:pickProcess}"
+        }
+    ]
+}

Controls/SanitizedHtmlLiteral/.vscode/tasks.json

@@ -0,0 +1,42 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "build",
+            "command": "dotnet",
+            "type": "process",
+            "args": [
+                "build",
+                "${workspaceFolder}/src/DotVVM.Contrib.Samples/DotVVM.Contrib.Samples.csproj",
+                "/property:GenerateFullPaths=true",
+                "/consoleloggerparameters:NoSummary"
+            ],
+            "problemMatcher": "$msCompile"
+        },
+        {
+            "label": "publish",
+            "command": "dotnet",
+            "type": "process",
+            "args": [
+                "publish",
+                "${workspaceFolder}/src/DotVVM.Contrib.Samples/DotVVM.Contrib.Samples.csproj",
+                "/property:GenerateFullPaths=true",
+                "/consoleloggerparameters:NoSummary"
+            ],
+            "problemMatcher": "$msCompile"
+        },
+        {
+            "label": "watch",
+            "command": "dotnet",
+            "type": "process",
+            "args": [
+                "watch",
+                "run",
+                "${workspaceFolder}/src/DotVVM.Contrib.Samples/DotVVM.Contrib.Samples.csproj",
+                "/property:GenerateFullPaths=true",
+                "/consoleloggerparameters:NoSummary"
+            ],
+            "problemMatcher": "$msCompile"
+        }
+    ]
+}

Controls/SanitizedHtmlLiteral/readme.md

@@ -0,0 +1,20 @@
+# SanitizedHtmlLiteral
+
+The control renders the Html property running it though a HtmlSanitizer.
+
+On server we use [mganss/HtmlSanitizer](https://github.com/mganss/HtmlSanitizer) and in Javascript we use [jitbit/HtmlSanitizer](https://github.com/jitbit/HtmlSanitizer).
+
+## Example
+
+When you have a `Html` property in view model, you can just show it on the page like this:
+
+```DOTHTML
+<dc:SanitizedHtmlLiteral Html={value: Html} />
+```
+
+If you don't need to refresh it on client-side, just use a `resource` binding, so we don't have to fetch the Javascript version of the sanitizer:
+
+
+```DOTHTML
+<dc:SanitizedHtmlLiteral Html={resource: Html} />
+```

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/DotVVM.Contrib.Samples.csproj

@@ -0,0 +1,25 @@
+<Project ToolsVersion="15.0" Sdk="Microsoft.NET.Sdk.Web">
+	<PropertyGroup>
+		<TargetFramework>netcoreapp2.0</TargetFramework>
+	</PropertyGroup>
+	<ItemGroup>
+		<Content Include="**\*.dothtml" />
+	</ItemGroup>
+	<ItemGroup>
+		<None Remove="dotvvm_serialized_config.json.tmp" />
+	</ItemGroup>
+	<ItemGroup>
+	  <Content Include="Views\_master.dotmaster" />
+	</ItemGroup>
+	<ItemGroup>
+		<Folder Include="wwwroot\" />
+	</ItemGroup>
+	<ItemGroup>
+		<PackageReference Include="Microsoft.AspNetCore" Version="2.0.2" />
+		<PackageReference Include="Microsoft.AspNetCore.StaticFiles" Version="2.0.2" />
+		<PackageReference Include="DotVVM.AspNetCore" Version="2.4.0.1" />
+	</ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\DotVVM.Contrib\DotVVM.Contrib.csproj" />
+  </ItemGroup>
+</Project>

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/DotvvmStartup.cs

@@ -0,0 +1,56 @@
+using System.Collections.Generic;
+using System.Linq;
+using DotVVM.Framework;
+using DotVVM.Framework.Configuration;
+using DotVVM.Framework.Routing;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace DotVVM.Contrib.Samples
+{
+    public class DotvvmStartup : IDotvvmStartup, IDotvvmServiceConfigurator
+    {
+        // For more information about this class, visit https://dotvvm.com/docs/tutorials/basics-project-structure
+        public void Configure(DotvvmConfiguration config, string applicationPath)
+        {
+            config.AddContribSanitizedHtmlLiteralConfiguration();
+
+            ConfigureRoutes(config, applicationPath);
+            ConfigureControls(config, applicationPath);
+            ConfigureResources(config, applicationPath);
+        }
+
+        private void ConfigureRoutes(DotvvmConfiguration config, string applicationPath)
+        {
+            config.RouteTable.Add("_Default", "", "Views/_default.dothtml");
+            config.RouteTable.AutoDiscoverRoutes(new SamplesRouteStrategy(config));
+        }
+
+        private void ConfigureControls(DotvvmConfiguration config, string applicationPath)
+        {
+            // register code-only controls and markup controls
+        }
+
+        private void ConfigureResources(DotvvmConfiguration config, string applicationPath)
+        {
+            // register custom resources and adjust paths to the built-in resources
+        }
+
+        public void ConfigureServices(IDotvvmServiceCollection services)
+        {
+            services.AddDefaultTempStorages("Temp");
+
+        }
+    }
+
+    internal class SamplesRouteStrategy : DefaultRouteStrategy
+    {
+        public SamplesRouteStrategy(DotvvmConfiguration config) : base(config)
+        {
+        }
+
+        protected override IEnumerable<RouteStrategyMarkupFileInfo> DiscoverMarkupFiles()
+        {
+            return base.DiscoverMarkupFiles().Where(r => !r.ViewsFolderRelativePath.StartsWith("_"));
+        }
+    }
+}

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/Program.cs

@@ -0,0 +1,24 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Hosting;
+
+namespace DotVVM.Contrib.Samples
+{
+    public class Program
+    {
+        public static void Main(string[] args)
+        {
+            var host = new WebHostBuilder()
+                .UseKestrel()
+                .UseContentRoot(Directory.GetCurrentDirectory())
+                .UseIISIntegration()
+                .UseStartup<Startup>()
+                .Build();
+
+            host.Run();
+        }
+    }
+}

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/Properties/launchSettings.json

@@ -0,0 +1,22 @@
+{
+  "iisSettings": {
+    "windowsAuthentication": false,
+    "anonymousAuthentication": true,
+    "iisExpress": {
+      "applicationUrl": "http://localhost:46582/",
+      "sslPort": 0
+    }
+  },
+  "profiles": {
+    "IIS Express": {
+      "commandName": "IISExpress",
+      "launchBrowser": true,
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "DotVVM.Contrib.Samples": {
+      "commandName": "Project"
+    }
+  }
+}

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/Startup.cs

@@ -0,0 +1,37 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+
+namespace DotVVM.Contrib.Samples
+{
+    public class Startup
+    {
+        // This method gets called by the runtime. Use this method to add services to the container.
+        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
+        public void ConfigureServices(IServiceCollection services)
+        {
+            services.AddDotVVM<DotvvmStartup>();
+        }
+
+        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
+        public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
+        {
+            loggerFactory.AddConsole();
+
+            // use DotVVM
+            var dotvvmConfiguration = app.UseDotVVM<DotvvmStartup>(env.ContentRootPath);
+
+            // use static files
+            app.UseStaticFiles(new StaticFileOptions
+            {
+                FileProvider = new Microsoft.Extensions.FileProviders.PhysicalFileProvider(env.WebRootPath)
+            });
+        }
+    }
+}

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/ViewModels/DefaultViewModel.cs

@@ -0,0 +1,13 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using DotVVM.Framework.ViewModel;
+
+namespace DotVVM.Contrib.Samples.ViewModels
+{
+	public class DefaultViewModel : MasterViewModel
+	{
+	}
+}
+

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/ViewModels/MasterViewModel.cs

@@ -0,0 +1,20 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using DotVVM.Framework.ViewModel;
+
+namespace DotVVM.Contrib.Samples.ViewModels
+{
+	public class MasterViewModel : DotvvmViewModelBase
+	{
+
+	    public string[] AllSamples => Context.Configuration.RouteTable
+                                          .Where(r => !r.RouteName.StartsWith("_"))
+                                          .Select(r => "/" + r.RouteName)
+                                          .OrderBy(r => r)
+                                          .ToArray();
+
+	}
+}
+

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/ViewModels/Sample1ViewModel.cs

@@ -0,0 +1,26 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using DotVVM.Framework.ViewModel;
+
+namespace DotVVM.Contrib.Samples.ViewModels
+{
+	public class Sample1ViewModel : MasterViewModel
+	{
+		public string[] Htmls { get; set; } = new [] { @"
+		<span style='color: red'> Hello </span>
+		<img src=something onerror='alert(1)' />
+		<script>alert(1)</script> 
+		"
+		};
+
+		[AllowStaticCommand]
+		public static string[] MoreHtmls() => new [] {
+			"<style> something </style>",
+			"<div style='position: absolute; top: 0; left: 0; width: 100vw; height: 100vh'> my content </div>",
+			"<span> nothing bad </span>"
+		};
+	}
+}
+

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/Views/Sample1.dothtml

@@ -0,0 +1,18 @@
+@viewModel DotVVM.Contrib.Samples.ViewModels.Sample1ViewModel, DotVVM.Contrib.Samples
+@masterPage Views/_master.dotmaster
+
+<dot:Content ContentPlaceHolderID="MainContent">
+
+
+    <dot:Repeater DataSource={value: Htmls}>
+        <SeparatorTemplate><hr /></SeparatorTemplate>
+        <p><dc:SanitizedHtmlLiteral Html={value: _this} /></p>
+        <dot:TextBox Type=Multiline Text={value: _this} UpdateTextAfterKeydown />
+    </dot:Repeater>
+
+
+
+    <!-- <dot:Button Text=Refresh Click={command: ;} />z -->
+    <dot:Button Text='Load more' Click={staticCommand: Htmls = Sample1ViewModel.MoreHtmls()} />
+</dot:Content>
+

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/Views/_default.dothtml

@@ -0,0 +1,9 @@
+@viewModel DotVVM.Contrib.Samples.ViewModels.DefaultViewModel, DotVVM.Contrib.Samples
+@masterPage Views/_master.dotmaster
+
+<dot:Content ContentPlaceHolderID="MainContent">
+
+    <!-- This page is left blank intentionally. Create a new page for each sample. -->
+
+</dot:Content>
+

Controls/SanitizedHtmlLiteral/src/DotVVM.Contrib.Samples/Views/_master.dotmaster

@@ -0,0 +1,26 @@
+@viewModel DotVVM.Contrib.Samples.ViewModels.MasterViewModel, DotVVM.Contrib.Samples
+
+<!DOCTYPE html>
+
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <meta charset="utf-8" />
+    <title></title>
+</head>
+<body>
+
+    <h1>SanitizedHtmlLiteral Samples</h1>
+
+    <dot:Repeater DataSource="{value: AllSamples}" WrapperTagName="ul">
+        <li style="display: inline-block">
+            <a href="{value: _this}">{{value: _this}}</a>
+        </li>
+    </dot:Repeater>
+    <hr />
+
+	<dot:ContentPlaceHolder ID="MainContent" />
+
+</body>
+</html>
+
+