|
| 1 | +// A hand-written test file that mimics the output of compiling a `.cshtml` file that has an |
| 2 | +// element with a tag helper (e.g. `asp-for`) and an HTML attribute whose value contains a |
| 3 | +// tainted expression, for example: <input asp-for="Value" value="@Model.Value"> |
| 4 | +#pragma checksum "RazorTagHelperAttribute.cshtml" "{ff1816ec-aa5e-4d10-87f7-6f4963833460}" "c4ae76542f1958092cebd8f57beef899d20fc548" |
| 5 | +// <auto-generated/> |
| 6 | +#pragma warning disable 1591 |
| 7 | +[assembly: global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute(typeof(dotnetweb.Pages.Pages_RazorTagHelperAttribute), @"mvc.1.0.razor-page", @"RazorTagHelperAttribute.cshtml")] |
| 8 | +namespace dotnetweb.Pages |
| 9 | +{ |
| 10 | + #line hidden |
| 11 | + using System; |
| 12 | + using System.Collections.Generic; |
| 13 | + using System.Linq; |
| 14 | + using System.Threading.Tasks; |
| 15 | + using Microsoft.AspNetCore.Mvc; |
| 16 | + using Microsoft.AspNetCore.Mvc.Rendering; |
| 17 | + using Microsoft.AspNetCore.Mvc.ViewFeatures; |
| 18 | +#nullable restore |
| 19 | +using dotnetweb; |
| 20 | + |
| 21 | +#line default |
| 22 | +#line hidden |
| 23 | +#nullable disable |
| 24 | + [global::Microsoft.AspNetCore.Razor.Hosting.RazorSourceChecksumAttribute(@"SHA1", @"c4ae76542f1958092cebd8f57beef899d20fc548", @"RazorTagHelperAttribute.cshtml")] |
| 25 | + public class Pages_RazorTagHelperAttribute : global::Microsoft.AspNetCore.Mvc.RazorPages.Page |
| 26 | + { |
| 27 | + #pragma warning disable 1998 |
| 28 | + public async override global::System.Threading.Tasks.Task ExecuteAsync() |
| 29 | + { |
| 30 | +#nullable restore |
| 31 | +#line 3 "RazorTagHelperAttribute.cshtml" |
| 32 | + |
| 33 | + var model = Request.Query["m"]; // $ Source=model |
| 34 | + |
| 35 | +#line default |
| 36 | +#line hidden |
| 37 | +#nullable disable |
| 38 | + WriteLiteral("<input type=\"text\" "); |
| 39 | + // GOOD: this `WriteLiteral` call is generated for the value of an HTML attribute on |
| 40 | + // an element with a tag helper (e.g. `asp-for`). It writes into an internal string |
| 41 | + // buffer via `BeginWriteTagHelperAttribute()`/`EndWriteTagHelperAttribute()`, and the |
| 42 | + // buffered text is HTML-attribute-encoded later, when the tag helper attribute value |
| 43 | + // is rendered. It is not a direct, unencoded write, so it must not be flagged. |
| 44 | + BeginWriteTagHelperAttribute(); |
| 45 | + WriteLiteral(model); |
| 46 | + var __tagHelperAttribute_1 = EndWriteTagHelperAttribute(); |
| 47 | + WriteLiteral(" />"); |
| 48 | + |
| 49 | + // BAD: a `WriteLiteral` call that is not bracketed by |
| 50 | + // `BeginWriteTagHelperAttribute()`/`EndWriteTagHelperAttribute()` writes directly, |
| 51 | + // unencoded, to the response and must still be flagged. |
| 52 | + WriteLiteral(model); // $ Alert=model |
| 53 | + |
| 54 | + // GOOD: two independent tag helper attribute brackets that occur one after another |
| 55 | + // in the same basic block must each be matched with their own nearest |
| 56 | + // `Begin`/`EndWriteTagHelperAttribute` call, and neither should leak into the other. |
| 57 | + BeginWriteTagHelperAttribute(); |
| 58 | + WriteLiteral("literal-prefix-"); |
| 59 | + var __tagHelperAttribute_2 = EndWriteTagHelperAttribute(); |
| 60 | + BeginWriteTagHelperAttribute(); |
| 61 | + WriteLiteral(model); |
| 62 | + var __tagHelperAttribute_3 = EndWriteTagHelperAttribute(); |
| 63 | + |
| 64 | + // BAD: a bare `WriteLiteral` call sandwiched between two unrelated tag helper |
| 65 | + // attribute brackets, in the same basic block, must not be mistaken for being |
| 66 | + // captured by either neighboring bracket. |
| 67 | + BeginWriteTagHelperAttribute(); |
| 68 | + WriteLiteral("prefix"); |
| 69 | + var __tagHelperAttribute_4 = EndWriteTagHelperAttribute(); |
| 70 | + WriteLiteral(model); // $ Alert=model |
| 71 | + BeginWriteTagHelperAttribute(); |
| 72 | + WriteLiteral("suffix"); |
| 73 | + var __tagHelperAttribute_5 = EndWriteTagHelperAttribute(); |
| 74 | + } |
| 75 | + #pragma warning restore 1998 |
| 76 | + [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute] |
| 77 | + public global::Microsoft.AspNetCore.Mvc.ViewFeatures.IModelExpressionProvider ModelExpressionProvider { get; private set; } |
| 78 | + [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute] |
| 79 | + public global::Microsoft.AspNetCore.Mvc.IUrlHelper Url { get; private set; } |
| 80 | + [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute] |
| 81 | + public global::Microsoft.AspNetCore.Mvc.IViewComponentHelper Component { get; private set; } |
| 82 | + [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute] |
| 83 | + public global::Microsoft.AspNetCore.Mvc.Rendering.IJsonHelper Json { get; private set; } |
| 84 | + [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute] |
| 85 | + public global::Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper<string> Html { get; private set; } |
| 86 | + public global::Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary<string> ViewData => (global::Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary<string>)PageContext?.ViewData; |
| 87 | + } |
| 88 | +} |
| 89 | +#pragma warning restore 1591 |
0 commit comments