asp.netasp.net-ajaxajaxcontroltoolkithtml-sanitizinghtmleditorextender

HtmlEditorExtender stripes out pre tag


I have coded my own quoting system since HtmlEditorExtender does not have a quote system. Or does it have?

asp.net 4.5 and ASP.NET AJAX Control Toolkit 16.1.0.0

In 2016 do we still not have whitelisting feature?

For quote, i am using pre tag. However, the latest HtmlEditorExtender in version 16.1.0 stripes out the pre tag. It just removes the part that contains pre tag.

I mean like

<pre><pre>CeFurkan: Wrote</pre>dsfsdfs</pre>

This is removed at the client side before posting to the server. How can i allow this tag?

I also tried with span class="myClass" and it removes class tag this time

my settings are

code behind

htmlEditorExtender1.EnableSanitization = true;

front code

<ajaxToolkit:HtmlEditorExtender ID="htmlEditorExtender1" TargetControlID="txtMessageBody"
                    runat="server" DisplaySourceTab="True">
                    <Toolbar>
                        <ajaxToolkit:Undo />
                        <ajaxToolkit:Redo />
                        <ajaxToolkit:Bold />
                        <ajaxToolkit:Italic />
                        <ajaxToolkit:Underline />
                        <ajaxToolkit:StrikeThrough />
                        <ajaxToolkit:Subscript />
                        <ajaxToolkit:Superscript />
                        <ajaxToolkit:JustifyLeft />
                        <ajaxToolkit:JustifyCenter />
                        <ajaxToolkit:JustifyRight />
                        <ajaxToolkit:JustifyFull />
                        <ajaxToolkit:InsertOrderedList />
                        <ajaxToolkit:InsertUnorderedList />
                        <ajaxToolkit:CreateLink />
                        <ajaxToolkit:UnLink />
                        <ajaxToolkit:RemoveFormat />
                        <ajaxToolkit:SelectAll />
                        <ajaxToolkit:UnSelect />
                        <ajaxToolkit:Delete />
                        <ajaxToolkit:Cut />
                        <ajaxToolkit:Copy />
                        <ajaxToolkit:Paste />
                        <ajaxToolkit:BackgroundColorSelector />
                        <ajaxToolkit:ForeColorSelector />
                        <ajaxToolkit:FontNameSelector />
                        <ajaxToolkit:FontSizeSelector />
                        <ajaxToolkit:Indent />
                        <ajaxToolkit:Outdent />
                        <ajaxToolkit:InsertHorizontalRule />
                        <ajaxToolkit:HorizontalSeparator />
                    </Toolbar>
                </ajaxToolkit:HtmlEditorExtender>

And web config

<ajaxControlToolkit useStaticResources="true" renderStyleLinks="false" htmlSanitizer="AjaxControlToolkit.HtmlEditor.Sanitizer.DefaultHtmlSanitizer, AjaxControlToolkit.HtmlEditor.Sanitizer" />

the full error it gives when the answer of Yuriy tried

    Value cannot be null.
Parameter name: type
Stack:
   at System.Activator.CreateInstance(Type type, Boolean nonPublic)
   at System.Activator.CreateInstance(Type type)
   at AjaxControlToolkit.HtmlEditorExtender.CreateSanitizer()
   at System.Lazy`1.CreateValue()
   at System.Lazy`1.LazyInitValue()
   at System.Lazy`1.get_Value()
   at AjaxControlToolkit.HtmlEditorExtender.get_Sanitizer()
   at AjaxControlToolkit.HtmlEditorExtender.OnInit(EventArgs e)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

class implementation

enter image description here


Solution

  • The most easiest way in my opinion is to create own implementation of the IHtmlSanitizer inheriting the DefaultHtmlSanitizer and override the GetSafeHtmlFragment method as below

    public class MyHtmlSanitizer : DefaultHtmlSanitizer, IHtmlSanitizer
    {
        private static readonly string[] whiteListTags = (ConfigurationManager.AppSettings["whiteListTags"] ?? "").Split(',');
    
        string IHtmlSanitizer.GetSafeHtmlFragment(string htmlFragment, Dictionary<string, string[]> whiteList)
        {
            foreach (var tag in whiteListTags)
            {
                if (!whiteList.ContainsKey(tag))
                    whiteList.Add(tag, new string[0]);
            }
    
            return base.GetSafeHtmlFragment(htmlFragment, whiteList);
    
        }
    }
    

    Then add to appSettings section of web.config setting for own tags white list:

    <appSettings>
      <add key="whiteListTags" value="pre"/>
    </appSettings>
    

    And configure toolkit to use this sanitizer instead of the default:

    <ajaxControlToolkit
      useStaticResources="true"
      renderStyleLinks="false"
      htmlSanitizer="AjaxControlToolkit.Customization.MyHtmlSanitizer, AjaxControlToolkit.Customization"
      tempFolder="~/Temp"/>