Search Results

Search found 54574 results on 2183 pages for 'asp net vb net'.

Page 153/2183 | < Previous Page | 149 150 151 152 153 154 155 156 157 158 159 160  | Next Page >

  • ASP Chart Control doesn't ahow anything

    - by Esabe
    Hi everyone, I am using the new ASP control "Chart", but I have some problems with it: I can't see anything when I execute the aspx. The data is binded to a ObjectDataSource, like this: <asp:Chart ID="RcrBufferChart" runat="server" Visible="true" DataSourceID="RcrBufferSizeODS" BackColor="WhiteSmoke" BackGradientStyle="TopBottom" BackSecondaryColor="White" Palette="BrightPastel" BorderDashStyle="Solid" BorderColor="26, 59, 105" Height="583px" Width="1159px" > <borderskin skinstyle="Emboss"></borderskin> <series> <asp:series Name="Series1" ChartType="Spline" ShadowColor="Black" BorderColor="180, 26, 59, 105" Color="224, 64, 10" IsValueShownAsLabel="True" XValueMember="CreationDate" XValueType="DateTime" YValueMembers="Size" YValueType="Double"></asp:series> </series> <chartareas> <asp:ChartArea Name="ChartArea1"> <AxisY Title="Tamaño RCR sin enviar"> </AxisY> <AxisX Title="Fecha"> </AxisX> </asp:ChartArea> </chartareas> </asp:Chart> <asp:ObjectDataSource ID="RcrBufferSizeODS" runat="server" SelectMethod="GetByAppliance" TypeName="Esabe.Grazalema.Business.RcrBufferSizes"> <SelectParameters> <asp:QueryStringParameter Name="serialNumber" QueryStringField="SerialNumber" Type="String" /> </SelectParameters> </asp:ObjectDataSource> but the result I get is the following: Does anyone know why it isn't showing anything? Thanks a lot in advance!!

    Read the article

  • C# (ASP.Net) Linking selection values to constants in Codebehind

    - by jasonvogel
    ASPX Code <asp:RadioButtonList ID="rbServer" runat="server" > <asp:ListItem Value=<%=ServerDeveloper%>> Developer </asp:ListItemv <asp:ListItem Value="dev.ahsvendor.com"> dev.test.com</asp:ListItem> <asp:ListItem Value="staging.ahsvendor.com"> staging.test.com</asp:ListItem> </asp:RadioButtonList> ASPX.CS - Codebehind const string ServerDeveloper = "developer"; ASPX Error: Code blocks are not supported in this context. Question: So what is the correct way to tie an dropdown/radio buttion/... ASPX value to a constant that is shared with the CodeBehind code? I know that I could do rbServer.Add.Item("developer") [from the CodeBehind], but is there a way to achieve it from the Presentation side of things?

    Read the article

  • Event is causing an error, but I can't catch the exception

    - by proudgeekdad
    A developer has created a custom control in ASP.NET using VB.NET. The custom control uses a repeater. In certain scenarios, the rpt_ItemDataBound event is encountering a data error. My goal is rather than having the user see the yellow screen of death, give the user a friendlier error explaining exactly what the data error is. I figured I would be able to use a Try/Catch block as shown below throw the exception, however, it appears that the event has nowhere to be thrown to and stops executing at the "End Try" line. Protected Sub rpt_ItemDataBound(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.RepeaterItemEventArgs) Handles rpt1.ItemDataBound, rpt2.ItemDataBound Try ProcessBadData... Catch ex As Exception Throw ex End Try End Sub In VB.NET, I can find where the repeater's DataSource is being set, however, I can not find a DataBind event. Any ideas how I can capture the exception in this ASCX control so I can report it to the user?

    Read the article

  • How can I open another tab in the browser from the Code Behind [duplicate]

    - by Daniel Powell
    This question already has an answer here: Response.Redirect to new window 18 answers I have an ASP.Net project that I am working on that involves opening another tab in the browser from the vb.net (code behind). I have tried to use the WebBrowser control to open the new tab as well as tried to use the Script manager however I have not been able to open the new tab. The button I am using is a custom button in a DevExpress GridView, and I am handling its click with this code: Private Sub ASPxGridView2_CustomButtonCallback(sender As Object, e As DevExpress.Web.ASPxGridView.ASPxGridViewCustomButtonCallbackEventArgs) Handles ASPxGridView2.CustomButtonCallback If e.ButtonID <> "customButton" Then Return End If Dim neededID = ASPxGridView2.GetRowValues(e.VisibleIndex, "target") Dim id = CStr(neededID) Dim url = ("targetPage.aspx" + "?ID=" + id) Dim wb As WebBrowser wb.Navigate(url,True) End Sub I'm not sure why this would not work, any suggestions as to how I should open a new browser tab with or without the WebBrowser works for this project. EDIT: I cannot use javascript with this ASPxGridview So I need an answer that doesn't involve modification to the javascript except through the vb.net code behind

    Read the article

  • Question on design of current pagination implementations

    - by Freshblood
    I have checked pagination implementations on asp.net mvc specifically and i really feel that there is something less efficient in implementations. First of all all implementations use pagination values like below. public ActionResult MostPopulars(int pageIndex,int pageSize) { } The thing that i feel wrong is pageIndex and pageSize totally should be member of Pagination class otherwise this way looks so much functional way. Also it simplify unnecesary paramater pass in tiers of application. Second thing is that they use below interface. public interface IPagedList<T> : IList<T> { int PageCount { get; } int TotalItemCount { get; } int PageIndex { get; } int PageNumber { get; } int PageSize { get; } bool HasPreviousPage { get; } bool HasNextPage { get; } bool IsFirstPage { get; } bool IsLastPage { get; } } If i want to routing my pagination to different action so i have to create new view model for encapsulate action name in it or even controller name. Another solution can be that sending this interfaced model to view then specify action and controller hard coded in pager method as parameter but i am losing totally re-usability of my view because it is strictly depends on just one action. Another thing is that they use below code in view Html.Pager(Model.PageSize, Model.PageNumber, Model.TotalItemCount) If the model is IPagedList why they don't provide an overload method like @Html.Pager(Model) or even better one is @Html.Pager(). You know that we know model type in this way. Before i was doing mistake because i was using Model.PageIndex instead of Model.PageNumber. Another big issue is they strongly rely on IQueryable interface. How they know that i use IQueryable in my data layer ? I would expected that they work simply with collections that is keep pagination implementation persistence ignorant. What is wrong about my improvement ideas over their pagination implementations ? What is their reason to not implement their paginations in this way ?

    Read the article

  • How to fix error "To run this application, you first must install one of the following version of the .Net Framework: v2.0.50727"?

    - by Gravitas
    How do I fix the error that started popping up in a lot of applications: To run this application, you first must install one of the following version of the .Net Framework: v2.0.50727. Would you like to download an install version v2.0.50727 of the .NET framework now? Unfortunately, this is not as simple as just installing the .NET 2.0 runtime, because its already installed. If I run the recommended installers for .NET 2.0 or .NET 3.5 SP1, it exits silently. Events leading to problem: Installed SQL Server 2008 R2, which installs a toy version of Visual Studio 2008 that only deals with SQL specific projects. Uninstalled Visual Studio 2008.

    Read the article

  • Using a dropdown on a static webpage as a DataSource in C#.net

    - by Matt
    I know this is a terrible way of doing things, but it's for an internal app where security is no issue. Basically, an old group created a php page with a drop down and this drop down is populated with entries from a DB. The DB owner is currently absent and for the sake of time, I would just need something that turns the entries in that drop down, always at the same url with the same ID every load into a List. Is there a quick, painless way to do this in .NET?

    Read the article

  • ADO.net Data Services - Querying

    - by Prajuvan
    Just I started learning ADO.NET Data Services. Some Pages show the querying like (sample) http://localhost:1705/ServiceExample/SomeService.svc/Persons(1)/Name http://localhost:1705/ServiceExample/SomeService.svc/Persons(1)/Name/$value Is it XPath or XQuery? Where can i get complete rules for forming such queries with examples? Thanks in advance.

    Read the article

  • Use a different *.config file, depending on IIS application pool .NET version

    - by LeeCambl
    I'm looking or a way to programmatically determine which version of the .NET Framework an application pool is using in IIS, at runtime, and for a website application to then use that information to choose which *.config file it should use. Is it possible? I'm not sure where to begin. Quite a broad question, and I'm open to any method of solving the problem, so fire away! Thanks in advance, you lovely Stack Overflowers!

    Read the article

  • The dynamic Type in C# Simplifies COM Member Access from Visual FoxPro

    - by Rick Strahl
    I’ve written quite a bit about Visual FoxPro interoperating with .NET in the past both for ASP.NET interacting with Visual FoxPro COM objects as well as Visual FoxPro calling into .NET code via COM Interop. COM Interop with Visual FoxPro has a number of problems but one of them at least got a lot easier with the introduction of dynamic type support in .NET. One of the biggest problems with COM interop has been that it’s been really difficult to pass dynamic objects from FoxPro to .NET and get them properly typed. The only way that any strong typing can occur in .NET for FoxPro components is via COM type library exports of Visual FoxPro components. Due to limitations in Visual FoxPro’s type library support as well as the dynamic nature of the Visual FoxPro language where few things are or can be described in the form of a COM type library, a lot of useful interaction between FoxPro and .NET required the use of messy Reflection code in .NET. Reflection is .NET’s base interface to runtime type discovery and dynamic execution of code without requiring strong typing. In FoxPro terms it’s similar to EVALUATE() functionality albeit with a much more complex API and corresponiding syntax. The Reflection APIs are fairly powerful, but they are rather awkward to use and require a lot of code. Even with the creation of wrapper utility classes for common EVAL() style Reflection functionality dynamically access COM objects passed to .NET often is pretty tedious and ugly. Let’s look at a simple example. In the following code I use some FoxPro code to dynamically create an object in code and then pass this object to .NET. An alternative to this might also be to create a new object on the fly by using SCATTER NAME on a database record. How the object is created is inconsequential, other than the fact that it’s not defined as a COM object – it’s a pure FoxPro object that is passed to .NET. Here’s the code: *** Create .NET COM InstanceloNet = CREATEOBJECT('DotNetCom.DotNetComPublisher') *** Create a Customer Object Instance (factory method) loCustomer = GetCustomer() loCustomer.Name = "Rick Strahl" loCustomer.Company = "West Wind Technologies" loCustomer.creditLimit = 9999999999.99 loCustomer.Address.StreetAddress = "32 Kaiea Place" loCustomer.Address.Phone = "808 579-8342" loCustomer.Address.Email = "[email protected]" *** Pass Fox Object and echo back values ? loNet.PassRecordObject(loObject) RETURN FUNCTION GetCustomer LOCAL loCustomer, loAddress loCustomer = CREATEOBJECT("EMPTY") ADDPROPERTY(loCustomer,"Name","") ADDPROPERTY(loCustomer,"Company","") ADDPROPERTY(loCUstomer,"CreditLimit",0.00) ADDPROPERTY(loCustomer,"Entered",DATETIME()) loAddress = CREATEOBJECT("Empty") ADDPROPERTY(loAddress,"StreetAddress","") ADDPROPERTY(loAddress,"Phone","") ADDPROPERTY(loAddress,"Email","") ADDPROPERTY(loCustomer,"Address",loAddress) RETURN loCustomer ENDFUNC Now prior to .NET 4.0 you’d have to access this object passed to .NET via Reflection and the method code to do this would looks something like this in the .NET component: public string PassRecordObject(object FoxObject) { // *** using raw Reflection string Company = (string) FoxObject.GetType().InvokeMember( "Company", BindingFlags.GetProperty,null, FoxObject,null); // using the easier ComUtils wrappers string Name = (string) ComUtils.GetProperty(FoxObject,"Name"); // Getting Address object – then getting child properties object Address = ComUtils.GetProperty(FoxObject,"Address");    string Street = (string) ComUtils.GetProperty(FoxObject,"StreetAddress"); // using ComUtils 'Ex' functions you can use . Syntax     string StreetAddress = (string) ComUtils.GetPropertyEx(FoxObject,"AddressStreetAddress"); return Name + Environment.NewLine + Company + Environment.NewLine + StreetAddress + Environment.NewLine + " FOX"; } Note that the FoxObject is passed in as type object which has no specific type. Since the object doesn’t exist in .NET as a type signature the object is passed without any specific type information as plain non-descript object. To retrieve a property the Reflection APIs like Type.InvokeMember or Type.GetProperty().GetValue() etc. need to be used. I made this code a little simpler by using the Reflection Wrappers I mentioned earlier but even with those ComUtils calls the code is pretty ugly requiring passing the objects for each call and casting each element. Using .NET 4.0 Dynamic Typing makes this Code a lot cleaner Enter .NET 4.0 and the dynamic type. Replacing the input parameter to the .NET method from type object to dynamic makes the code to access the FoxPro component inside of .NET much more natural: public string PassRecordObjectDynamic(dynamic FoxObject) { // *** using raw Reflection string Company = FoxObject.Company; // *** using the easier ComUtils class string Name = FoxObject.Name; // *** using ComUtils 'ex' functions to use . Syntax string Address = FoxObject.Address.StreetAddress; return Name + Environment.NewLine + Company + Environment.NewLine + Address + Environment.NewLine + " FOX"; } As you can see the parameter is of type dynamic which as the name implies performs Reflection lookups and evaluation on the fly so all the Reflection code in the last example goes away. The code can use regular object ‘.’ syntax to reference each of the members of the object. You can access properties and call methods this way using natural object language. Also note that all the type casts that were required in the Reflection code go away – dynamic types like var can infer the type to cast to based on the target assignment. As long as the type can be inferred by the compiler at compile time (ie. the left side of the expression is strongly typed) no explicit casts are required. Note that although you get to use plain object syntax in the code above you don’t get Intellisense in Visual Studio because the type is dynamic and thus has no hard type definition in .NET . The above example calls a .NET Component from VFP, but it also works the other way around. Another frequent scenario is an .NET code calling into a FoxPro COM object that returns a dynamic result. Assume you have a FoxPro COM object returns a FoxPro Cursor Record as an object: DEFINE CLASS FoxData AS SESSION OlePublic cAppStartPath = "" FUNCTION INIT THIS.cAppStartPath = ADDBS( JustPath(Application.ServerName) ) SET PATH TO ( THIS.cAppStartpath ) ENDFUNC FUNCTION GetRecord(lnPk) LOCAL loCustomer SELECT * FROM tt_Cust WHERE pk = lnPk ; INTO CURSOR TCustomer IF _TALLY < 1 RETURN NULL ENDIF SCATTER NAME loCustomer MEMO RETURN loCustomer ENDFUNC ENDDEFINE If you call this from a .NET application you can now retrieve this data via COM Interop and cast the result as dynamic to simplify the data access of the dynamic FoxPro type that was created on the fly: int pk = 0; int.TryParse(Request.QueryString["id"],out pk); // Create Fox COM Object with Com Callable Wrapper FoxData foxData = new FoxData(); dynamic foxRecord = foxData.GetRecord(pk); string company = foxRecord.Company; DateTime entered = foxRecord.Entered; This code looks simple and natural as it should be – heck you could write code like this in days long gone by in scripting languages like ASP classic for example. Compared to the Reflection code that previously was necessary to run similar code this is much easier to write, understand and maintain. For COM interop and Visual FoxPro operation dynamic type support in .NET 4.0 is a huge improvement and certainly makes it much easier to deal with FoxPro code that calls into .NET. Regardless of whether you’re using COM for calling Visual FoxPro objects from .NET (ASP.NET calling a COM component and getting a dynamic result returned) or whether FoxPro code is calling into a .NET COM component from a FoxPro desktop application. At one point or another FoxPro likely ends up passing complex dynamic data to .NET and for this the dynamic typing makes coding much cleaner and more readable without having to create custom Reflection wrappers. As a bonus the dynamic runtime that underlies the dynamic type is fairly efficient in terms of making Reflection calls especially if members are repeatedly accessed. © Rick Strahl, West Wind Technologies, 2005-2010Posted in COM  FoxPro  .NET  CSharp  

    Read the article

  • WCF is throwing UnauthorizedAccessExceptyion after upgrade to .NET 4.0

    - by Andrey
    I have a pretty simple client-server ASP.NET app; communication is via WCF service. All worked perferctly inVS 2008, now I upgraded to VS2010 and every time the client code is trying to instantiate a channel to the server: new ChannelFactory<IMemberService>("Members.MemberService").CreateChannel(); it throws an UnauthorizedAccessException "Access denied". Were there any breaking changes in the new version, or do I need to add some configuration? I'm pretty stuck, any ideas would be highly appreciated! BTW, binding used is basicHttpBinding, i don't know if thats important here. Thank you, Andrey

    Read the article

  • Creating WSRP portlet with .net

    - by Evan
    I'm working on a project where I need to create a WSRP portlet webservice with ASP.net. My first question is what exactly is WSRP, and are there any good examples of it available? So far I have determined that it is a SOAP xml standard that defines how to create a portlet that can be embedded in an other portal. Is that correct? Also I was planning on using MVC to do this. Is this a good idea? Any thoughts on WSRP are welcome. I'm still trying to figure out exactly what it is and how to create it.

    Read the article

  • Sending and Receiving data through SOAP web service in .Net

    - by Nikhil Thaker
    I am working on a client - server application and in which I used to send and receive data through SOAP web service. Now after sometimes I have heard from someone that I might lost some data while this process on soap service created in ASP.net. So now I have decided to send and receive data through batches like first I will send List of 50 objects and then next 50 and so on... Now I am new to web services and all. So my question is "Is it true that we can lost some data sometimes while transferring it through SOAP web service?"

    Read the article

  • .Net LoginControls - User can't logout in Firefox

    - by Jordan Foreman
    Basically, the logout link doesn't do anything, but only in Firefox. (I can login and out freely from other browsers) There really isn't a whole lot of information I can really give other than that, since I'm still new to this project and .net as a whole, and know almost nothing about the login controls. So if someone else has experienced a similar issue in the past, and can recognize the issue with the little info I have, that would be great! If not, sorry for the lack of depth, but its all I have. If it helps, here is the code for where the logout link is: <LoggedInTemplate> ... <asp:LoginStatus ID="HeadLoginStatus" runat="server" LogoutAction="Redirect" LogoutText="Log Out" LogoutPageUrl="~/Anonymous/Login.aspx" /> </LoggedInTemplate>

    Read the article

  • .NET "Timer" would block other method calls?

    - by Ricky
    Hi guys: In ASP.NET 3.5, we suspect a delegate triggering by a "Timer" will block other method calls. From logs, some function calls will wait for the finishing of the delegate and continue to work. Is it true? If yes, what workaround can I do? PS: The delegate contains codes to use WCF to retrieve data and the following code private void Replace<T>(ref IList<T> src, IList<T> des) { lock(src) { while (src.Count > 0) { GC.SuppressFinalize(src.ElementAt(0)); src.RemoveAt(0); } GC.SuppressFinalize(src); src = des; } } Thanks a lot.

    Read the article

  • Speaking at Microsoft's Duth DevDays

    - by gsusx
    Last week I had the pleasure of presenting two sessions at Microsoft's Dutch DevDays at Den Hague. On Tuesday I presented a sessions about how to implement real world RESTFul services patterns using WCF, WCF Data Services and ASP.NET MVC2. During that session I showed a total of 15 small demos that highlighted how to implement key aspects of RESTful solutions such as Security, LowREST clients, URI modeling, Validation, Error Handling, etc. As part of those demos I used the OAuth implementation created...(read more)

    Read the article

  • Programmatically updating one update panel elements from another update panel elements

    - by Jalpesh P. Vadgama
    While taking interviews for asp.net candidate I am often asking this question but most peoples are not able to give this answer. So I decided to write a blog post about this. Here is the scenario. There are two update panels in my html code in first update panel there is textbox hello world and another update panel there is a button called btnHelloWorld. Now I want to update textbox text in button click event without post back. But in normal scenario It will not update the textbox text as both are in different update panel. Here is the code for that. <form id="form1" runat="server"> <asp:ScriptManager ID="myScriptManager" runat="server" EnableCdn="true"></asp:ScriptManager> <asp:UpdatePanel ID="firstUpdatePanel" runat="server" UpdateMode="Conditional"> <ContentTemplate> <asp:TextBox ID="txtHelloWorld" runat="server"></asp:TextBox> </ContentTemplate> </asp:UpdatePanel> <asp:UpdatePanel ID="secondUpdatePanel" runat="server" UpdateMode="Conditional"> <ContentTemplate> <asp:Button ID="btnHelloWorld" runat="server" Text="Print Hello World" onclick="btnHelloWorld_Click" /> </ContentTemplate> </asp:UpdatePanel> </form> Here comes magic!!. Lots of people don’t know that update panel are providing the Update method from which we can programmatically update the update panel elements without post back. Below is code for that. protected void btnHelloWorld_Click(object sender, System.EventArgs e) { txtHelloWorld.Text = "Hello World!!!"; firstUpdatePanel.Update(); } That’s it here I have updated the firstUpdatePanel from the code!!!. Hope you liked it.. Stay tuned for more..Happy Programming.. Technorati Tags: UpdatePanel,ASP.NET

    Read the article

  • .NET HTML Sanitation for rich HTML Input

    - by Rick Strahl
    Recently I was working on updating a legacy application to MVC 4 that included free form text input. When I set up the new site my initial approach was to not allow any rich HTML input, only simple text formatting that would respect a few simple HTML commands for bold, lists etc. and automatically handles line break processing for new lines and paragraphs. This is typical for what I do with most multi-line text input in my apps and it works very well with very little development effort involved. Then the client sprung another note: Oh by the way we have a bunch of customers (real estate agents) who need to post complete HTML documents. Oh uh! There goes the simple theory. After some discussion and pleading on my part (<snicker>) to try and avoid this type of raw HTML input because of potential XSS issues, the client decided to go ahead and allow raw HTML input anyway. There has been lots of discussions on this subject on StackOverFlow (and here and here) but to after reading through some of the solutions I didn't really find anything that would work even closely for what I needed. Specifically we need to be able to allow just about any HTML markup, with the exception of script code. Remote CSS and Images need to be loaded, links need to work and so. While the 'legit' HTML posted by these agents is basic in nature it does span most of the full gamut of HTML (4). Most of the solutions XSS prevention/sanitizer solutions I found were way to aggressive and rendered the posted output unusable mostly because they tend to strip any externally loaded content. In short I needed a custom solution. I thought the best solution to this would be to use an HTML parser - in this case the Html Agility Pack - and then to run through all the HTML markup provided and remove any of the blacklisted tags and a number of attributes that are prone to JavaScript injection. There's much discussion on whether to use blacklists vs. whitelists in the discussions mentioned above, but I found that whitelists can make sense in simple scenarios where you might allow manual HTML input, but when you need to allow a larger array of HTML functionality a blacklist is probably easier to manage as the vast majority of elements and attributes could be allowed. Also white listing gets a bit more complex with HTML5 and the new proliferation of new HTML tags and most new tags generally don't affect XSS issues directly. Pure whitelisting based on elements and attributes also doesn't capture many edge cases (see some of the XSS cheat sheets listed below) so even with a white list, custom logic is still required to handle many of those edge cases. The Microsoft Web Protection Library (AntiXSS) My first thought was to check out the Microsoft AntiXSS library. Microsoft has an HTML Encoding and Sanitation library in the Microsoft Web Protection Library (formerly AntiXSS Library) on CodePlex, which provides stricter functions for whitelist encoding and sanitation. Initially I thought the Sanitation class and its static members would do the trick for me,but I found that this library is way too restrictive for my needs. Specifically the Sanitation class strips out images and links which rendered the full HTML from our real estate clients completely useless. I didn't spend much time with it, but apparently I'm not alone if feeling this library is not really useful without some way to configure operation. To give you an example of what didn't work for me with the library here's a small and simple HTML fragment that includes script, img and anchor tags. I would expect the script to be stripped and everything else to be left intact. Here's the original HTML:var value = "<b>Here</b> <script>alert('hello')</script> we go. Visit the " + "<a href='http://west-wind.com'>West Wind</a> site. " + "<img src='http://west-wind.com/images/new.gif' /> " ; and the code to sanitize it with the AntiXSS Sanitize class:@Html.Raw(Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment(value)) This produced a not so useful sanitized string: Here we go. Visit the <a>West Wind</a> site. While it removed the <script> tag (good) it also removed the href from the link and the image tag altogether (bad). In some situations this might be useful, but for most tasks I doubt this is the desired behavior. While links can contain javascript: references and images can 'broadcast' information to a server, without configuration to tell the library what to restrict this becomes useless to me. I couldn't find any way to customize the white list, nor is there code available in this 'open source' library on CodePlex. Using Html Agility Pack for HTML Parsing The WPL library wasn't going to cut it. After doing a bit of research I decided the best approach for a custom solution would be to use an HTML parser and inspect the HTML fragment/document I'm trying to import. I've used the HTML Agility Pack before for a number of apps where I needed an HTML parser without requiring an instance of a full browser like the Internet Explorer Application object which is inadequate in Web apps. In case you haven't checked out the Html Agility Pack before, it's a powerful HTML parser library that you can use from your .NET code. It provides a simple, parsable HTML DOM model to full HTML documents or HTML fragments that let you walk through each of the elements in your document. If you've used the HTML or XML DOM in a browser before you'll feel right at home with the Agility Pack. Blacklist based HTML Parsing to strip XSS Code For my purposes of HTML sanitation, the process involved is to walk the HTML document one element at a time and then check each element and attribute against a blacklist. There's quite a bit of argument of what's better: A whitelist of allowed items or a blacklist of denied items. While whitelists tend to be more secure, they also require a lot more configuration. In the case of HTML5 a whitelist could be very extensive. For what I need, I only want to ensure that no JavaScript is executed, so a blacklist includes the obvious <script> tag plus any tag that allows loading of external content including <iframe>, <object>, <embed> and <link> etc. <form>  is also excluded to avoid posting content to a different location. I also disallow <head> and <meta> tags in particular for my case, since I'm only allowing posting of HTML fragments. There is also some internal logic to exclude some attributes or attributes that include references to JavaScript or CSS expressions. The default tag blacklist reflects my use case, but is customizable and can be added to. Here's my HtmlSanitizer implementation:using System.Collections.Generic; using System.IO; using System.Xml; using HtmlAgilityPack; namespace Westwind.Web.Utilities { public class HtmlSanitizer { public HashSet<string> BlackList = new HashSet<string>() { { "script" }, { "iframe" }, { "form" }, { "object" }, { "embed" }, { "link" }, { "head" }, { "meta" } }; /// <summary> /// Cleans up an HTML string and removes HTML tags in blacklist /// </summary> /// <param name="html"></param> /// <returns></returns> public static string SanitizeHtml(string html, params string[] blackList) { var sanitizer = new HtmlSanitizer(); if (blackList != null && blackList.Length > 0) { sanitizer.BlackList.Clear(); foreach (string item in blackList) sanitizer.BlackList.Add(item); } return sanitizer.Sanitize(html); } /// <summary> /// Cleans up an HTML string by removing elements /// on the blacklist and all elements that start /// with onXXX . /// </summary> /// <param name="html"></param> /// <returns></returns> public string Sanitize(string html) { var doc = new HtmlDocument(); doc.LoadHtml(html); SanitizeHtmlNode(doc.DocumentNode); //return doc.DocumentNode.WriteTo(); string output = null; // Use an XmlTextWriter to create self-closing tags using (StringWriter sw = new StringWriter()) { XmlWriter writer = new XmlTextWriter(sw); doc.DocumentNode.WriteTo(writer); output = sw.ToString(); // strip off XML doc header if (!string.IsNullOrEmpty(output)) { int at = output.IndexOf("?>"); output = output.Substring(at + 2); } writer.Close(); } doc = null; return output; } private void SanitizeHtmlNode(HtmlNode node) { if (node.NodeType == HtmlNodeType.Element) { // check for blacklist items and remove if (BlackList.Contains(node.Name)) { node.Remove(); return; } // remove CSS Expressions and embedded script links if (node.Name == "style") { if (string.IsNullOrEmpty(node.InnerText)) { if (node.InnerHtml.Contains("expression") || node.InnerHtml.Contains("javascript:")) node.ParentNode.RemoveChild(node); } } // remove script attributes if (node.HasAttributes) { for (int i = node.Attributes.Count - 1; i >= 0; i--) { HtmlAttribute currentAttribute = node.Attributes[i]; var attr = currentAttribute.Name.ToLower(); var val = currentAttribute.Value.ToLower(); span style="background: white; color: green">// remove event handlers if (attr.StartsWith("on")) node.Attributes.Remove(currentAttribute); // remove script links else if ( //(attr == "href" || attr== "src" || attr == "dynsrc" || attr == "lowsrc") && val != null && val.Contains("javascript:")) node.Attributes.Remove(currentAttribute); // Remove CSS Expressions else if (attr == "style" && val != null && val.Contains("expression") || val.Contains("javascript:") || val.Contains("vbscript:")) node.Attributes.Remove(currentAttribute); } } } // Look through child nodes recursively if (node.HasChildNodes) { for (int i = node.ChildNodes.Count - 1; i >= 0; i--) { SanitizeHtmlNode(node.ChildNodes[i]); } } } } } Please note: Use this as a starting point only for your own parsing and review the code for your specific use case! If your needs are less lenient than mine were you can you can make this much stricter by not allowing src and href attributes or CSS links if your HTML doesn't allow it. You can also check links for external URLs and disallow those - lots of options.  The code is simple enough to make it easy to extend to fit your use cases more specifically. It's also quite easy to make this code work using a WhiteList approach if you want to go that route. The code above is semi-generic for allowing full featured HTML fragments that only disallow script related content. The Sanitize method walks through each node of the document and then recursively drills into all of its children until the entire document has been traversed. Note that the code here uses an XmlTextWriter to write output - this is done to preserve XHTML style self-closing tags which are otherwise left as non-self-closing tags. The sanitizer code scans for blacklist elements and removes those elements not allowed. Note that the blacklist is configurable either in the instance class as a property or in the static method via the string parameter list. Additionally the code goes through each element's attributes and looks for a host of rules gleaned from some of the XSS cheat sheets listed at the end of the post. Clearly there are a lot more XSS vulnerabilities, but a lot of them apply to ancient browsers (IE6 and versions of Netscape) - many of these glaring holes (like CSS expressions - WTF IE?) have been removed in modern browsers. What a Pain To be honest this is NOT a piece of code that I wanted to write. I think building anything related to XSS is better left to people who have far more knowledge of the topic than I do. Unfortunately, I was unable to find a tool that worked even closely for me, or even provided a working base. For the project I was working on I had no choice and I'm sharing the code here merely as a base line to start with and potentially expand on for specific needs. It's sad that Microsoft Web Protection Library is currently such a train wreck - this is really something that should come from Microsoft as the systems vendor or possibly a third party that provides security tools. Luckily for my application we are dealing with a authenticated and validated users so the user base is fairly well known, and relatively small - this is not a wide open Internet application that's directly public facing. As I mentioned earlier in the post, if I had my way I would simply not allow this type of raw HTML input in the first place, and instead rely on a more controlled HTML input mechanism like MarkDown or even a good HTML Edit control that can provide some limits on what types of input are allowed. Alas in this case I was overridden and we had to go forward and allow *any* raw HTML posted. Sometimes I really feel sad that it's come this far - how many good applications and tools have been thwarted by fear of XSS (or worse) attacks? So many things that could be done *if* we had a more secure browser experience and didn't have to deal with every little script twerp trying to hack into Web pages and obscure browser bugs. So much time wasted building secure apps, so much time wasted by others trying to hack apps… We're a funny species - no other species manages to waste as much time, effort and resources as we humans do :-) Resources Code on GitHub Html Agility Pack XSS Cheat Sheet XSS Prevention Cheat Sheet Microsoft Web Protection Library (AntiXss) StackOverflow Links: http://stackoverflow.com/questions/341872/html-sanitizer-for-net http://blog.stackoverflow.com/2008/06/safe-html-and-xss/ http://code.google.com/p/subsonicforums/source/browse/trunk/SubSonic.Forums.Data/HtmlScrubber.cs?r=61© Rick Strahl, West Wind Technologies, 2005-2012Posted in Security  HTML  ASP.NET  JavaScript   Tweet !function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0];if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src="//platform.twitter.com/widgets.js";fjs.parentNode.insertBefore(js,fjs);}}(document,"script","twitter-wjs"); (function() { var po = document.createElement('script'); po.type = 'text/javascript'; po.async = true; po.src = 'https://apis.google.com/js/plusone.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(po, s); })();

    Read the article

  • Visual Studio 2010 Guatemala Community Launch

    - by carlone
      Bien Amig@s, el momento tan esperado ha llegado. Para dar nuevamente empuje a la Comunidad de Desarrolladores de .NET de Guatemala, hemos logrado confirmar el evento apoyados por Microsoft Guatemala. Este será un evento de 3 días en donde tendremos la oportunidad de visualizar todas las nuevas características, mejoras, tecnologías y herramientas disponibles en Visual Studio 2010. Cuando: Las sesiones se llevarán a cabo los días 23,24 y 25 de Junio del 2010 Donde: En las oficinas de Microsoft Guatemala 3a Avenida 13-78 Zona 10 Torre City Bank Off. 1101 Guatemala City Guatemala Costo: $0, si NADA, solo tu entusiasmo, participación y apoyo para el evento.   Temas: Silverlight/WPF 4.0 Development Session              23 de Junio Office Sharepoint Development Session                 24 de Junio ASP.NET and Web Development Session                25 de Junio   Give Aways: Si…., habrán sorpresas para los asistentes, así como también podremos compartir una pizza, alitas de pollo y más ….   Como me Inscribo para participar:   Muy simple, visita la siguiente página http://vs2010gt.eventbrite.com/ y listo.   Riega la Bola!, invita a tu colega, a tu amigo geek, la mara de la U, a los de la Office, es una única oportunidad que no te puedes perder. Esperamos contar con tu participación !!!!!!!!!!!!!!!   Saludos Cordiales, Carlos A. Lone sigueme en Twitter: @carloslonegt

    Read the article

  • There are 2 jobs available - which one sounds better all round [closed]

    - by Steve Gates
    I am currently employed at a company where we scrape by each year breaking even, sometimes having a little profit. The development environment is very relaxed and we have a laugh. My colleagues are not interested in improving their knowledge unless they have to, so trying to get them to adopt things like TDD is a non-starter. My development manager is stuck in .Net 2 land and refuses to use things like LINQ. He over complicates architecture and writes very unreadable code, heres an example SortedList<int,<SortedList<int,SortedList<int, MyClass>>>> The MD of the company has no drive and lets the one sales guy bring in the contracts. We are not busy all the time and this allows me time to look at new technology and learn. In terms of using things like TDD, my development manager has no problem with it and can kind of see the purpose of it, he just wont use it himself. This means I am alone in learning new things and am often resorting to StackOverflow to make sure I get things right. The company has a lot of flexibility, I can work from home if needs be and when my daughter was born they let me work from home 1 day a week however they expect this flexibility in return often asking me to travel occasionally on a Friday afternoon for the following week. Sometimes its abroad. We are also pretty much on call 24/5 as we have engineers in various countries. Also we have no testers so most of the testing is done by us developers and some testing by engineers. Either way no-one likes testing! I have been offered a role at a company I worked at 5 years ago. They were quite Victorian in their working practices but it appears to have relaxed now although I suspect still reasonably formal. There is a new team of developers I don't know and they are about to move to new offices. The team lead is a guy that was there when I was and I get the impression he takes his role seriously and likes his formal procedures and documentation. I think some of the Victorian practices may have rubbed off on him. However he did say if things crop up then as long as I can trust the person they can work at home although he prefers people in the office. The team uses SCRUM, TDD and SOLID design principles so they are quite up to date in technology. They are reasonably Microsoft focused. It appears the Technical Director might be the R&D man and research new technology on his own not allowing developers to play with new technology. He possibly might be a super developer and makes all the decisions that no can argue with. They are currently moving to Entity Framework away from NHibernate based on issues that their queries seem to fail sometimes and they feel NHibernate is stagnant. They have analysts and a QA team. The MD is focused and they are an expanding company making profit each year. I'm not sure what the team morale is and whether they have a laugh. When I had a tour around the office they were there in dead silence. I'm really unsure which role is the best for me and going with my gut instinct is useless as I'm not sure what my gut is telling me. Based on the information above which role would you choose and why?

    Read the article

< Previous Page | 149 150 151 152 153 154 155 156 157 158 159 160  | Next Page >