[英]Automatically HtmlEncode strings when the model is serialized with Json.Net
是否有一种方法可以将Json.Net配置为在序列化模型时自动编码所有字符串,如HtmlEncode(myString)
?
您可以使用类似于反序列化期间在字符串中选择性地转义HTML的解决方案,并进行一些小的更改:
HtmlEncodingValueProvider
以在GetValue
而不是SetValue
应用编码(以便它在序列化而不是反序列化时执行编码)。 以下是生成的代码的样子:
public class CustomResolver : DefaultContractResolver
{
protected override IList<JsonProperty> CreateProperties(Type type, MemberSerialization memberSerialization)
{
IList<JsonProperty> props = base.CreateProperties(type, memberSerialization);
// Attach an HtmlEncodingValueProvider instance to all string properties
foreach (JsonProperty prop in props.Where(p => p.PropertyType == typeof(string)))
{
PropertyInfo pi = type.GetProperty(prop.UnderlyingName);
if (pi != null)
{
prop.ValueProvider = new HtmlEncodingValueProvider(pi);
}
}
return props;
}
protected class HtmlEncodingValueProvider : IValueProvider
{
PropertyInfo targetProperty;
public HtmlEncodingValueProvider(PropertyInfo targetProperty)
{
this.targetProperty = targetProperty;
}
// SetValue gets called by Json.Net during deserialization.
// The value parameter has the original value read from the JSON;
// target is the object on which to set the value.
public void SetValue(object target, object value)
{
targetProperty.SetValue(target, (string)value);
}
// GetValue is called by Json.Net during serialization.
// The target parameter has the object from which to read the string;
// the return value is the string that gets written to the JSON
public object GetValue(object target)
{
string value = (string)targetProperty.GetValue(target);
return System.Web.HttpUtility.HtmlEncode(value);
}
}
}
像这样使用自定义ContractResolver
:
var settings = new JsonSerializerSettings
{
ContractResolver = new CustomResolver(),
Formatting = Formatting.Indented
};
string json = JsonConvert.SerializeObject(your_object, settings);
小提琴: https : //dotnetfiddle.net/RhFlk8
尝试这个:
var json = JObject.Parse("{'Name':'<script>alert(1);</script>'}");
var serializerSettings = new JsonSerializerSettings()
{
StringEscapeHandling = StringEscapeHandling.EscapeHtml
};
var result = JsonConvert.SerializeObject(json, serializerSettings);
结果将是:
{"Name":"\u003cscript\u003ealert(1);\u003c/script\u003e"}
我发现了一个非常简单的方法(WebAPI2)。
设置对象属性时,只需使用下面的代码进行编码即可。
myObject.encoded_field = HttpUtility.HtmlEncode(your_html_content)
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.