This is a migrated thread and some comments may be shown as answers.

Html encoding problems

9 Answers 413 Views

DropDownList

This is a migrated thread and some comments may be shown as answers.

Andreas asked on 17 Oct 2013, 09:19 AM

Hi,

What is the deal with html encoding in RadDropDownList?
Can't make it work correctly...

I suppose that we should html encode the text property of the items?
But even if doing so, there will problems when selecting items...

See the following sample:

<%@ Page Language="vb" AutoEventWireup="false" CodeBehind="dropdownlist.aspx.vb" Inherits="TestaTredjepartWeb.dropdownlist" %>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">

<head runat="server">

<title></title>

</head>

<body>

<form id="form1" runat="server">

<asp:ScriptManager ID="s" runat="server">

</asp:ScriptManager>

<div>

<telerik:RadDropDownList ID="ddl" runat="server">

</telerik:RadDropDownList>

</div>

</form>

</body>

</html>

Code behind:

Public Class dropdownlist

Inherits System.Web.UI.Page

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

ddl.Items.Add(New Telerik.Web.UI.DropDownListItem(HttpUtility.HtmlEncode("<script>alert('hello1');</script>"), "1"))

ddl.Items.Add(New Telerik.Web.UI.DropDownListItem(HttpUtility.HtmlEncode("<script>alert('hello2');</script>"), "2"))

End Sub

End Class

When selecting item 2 in the dropdown the alert will display (hello2) and the text in the dropdown will be empty.
Is there any workaround for this?

Regards
Andreas

9 Answers, 1 is accepted

answered on 22 Oct 2013, 11:21 AM

Hello Andreas,

The experienced behavior is caused by a bug with the RadDropDownList, where the text content is evaluated once set in the "input " part of the control. The issue is already log for fixing, as a token of gratitude for this bug report your Telerik points are updated. As a temporary solution until the issue is fixed you could place the following script on the page where the RadDropDownList resides:

Telerik.Web.UI.RadDropDownList.prototype._updateTextElement = function(value) {

var $element = $telerik.$(this.get_textElement());

if (value) {

$element.text(value);

$element.removeClass("rddlDefaultMessage");

}

else {

$element.html(this.get_defaultMessage());

$element.addClass("rddlDefaultMessage");

}

this.get_element().value = value;

}

Regards,
Dimitar Terziev
Telerik

If you want to get updates on new releases, tips and tricks and sneak peeks at our product labs directly from the developers working on the RadControls for ASP.NET AJAX, subscribe to the blog feed now.

answered on 31 Oct 2013, 09:16 PM

Well, it almost works...

If setting the dropdown to autopostback and selecting the same item that was already selected, the text gets encoded twice.
Sample:

<%@ Page Language="vb" AutoEventWireup="false" CodeBehind="dropdownlist.aspx.vb" Inherits="TestaTredjepartWeb.dropdownlist" %>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">

<head runat="server">

<title></title>

</head>

<body>

<form id="form1" runat="server">

<asp:ScriptManager ID="s" runat="server">

</asp:ScriptManager>

<div>

<telerik:RadDropDownList ID="ddl" runat="server" AutoPostBack="true">

</telerik:RadDropDownList>

</div>

<script type="text/javascript">

Telerik.Web.UI.RadDropDownList.prototype._updateTextElement = function (value)

{

var $element = $telerik.$(this.get_textElement());

if (value)

{

$element.text(value);

$element.removeClass("rddlDefaultMessage");

}

else

{

$element.html(this.get_defaultMessage());

$element.addClass("rddlDefaultMessage");

}

this.get_element().value = value;

}

</script>

</form>

</body>

</html>

Public Class dropdownlist

Inherits System.Web.UI.Page

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

If Not Me.IsPostBack Then

ddl.Items.Add(New Telerik.Web.UI.DropDownListItem(HttpUtility.HtmlEncode("<script>alert('hello1');</script>"), "1"))

ddl.Items.Add(New Telerik.Web.UI.DropDownListItem(HttpUtility.HtmlEncode("<script>alert('hello2');</script>"), "2"))

End If

End Sub

End Class

In this sample, when clicking the first item (that is already selected), the text gets encoded twice!

Any workaround for this also?

Regards
Andreas

answered on 18 Nov 2013, 10:42 AM

Hello,

By default the text of the DropDownItems is not encoded and this should be done manually. The fix included in the service pack addresses the issue that even encoded, the text content is evaluated when set to the "input".

@Andreas
The problem with the double encoding was not yet fixed, since the fix could introduce a breaking change. I shall try to provide an override which addresses this problem.

Regards,
Dimitar Terziev
Telerik

answered on 22 Nov 2013, 08:49 AM

sample.zip

Hi,

Attached is a sample page showing how to overcome the problem with the text encoding as well as the problem with the double encoding when the already selected item is selected again.

Regards,
Dimitar Terziev
Telerik