[Solved] Column encoding not working

[Salo Corgan]

I have a grid as set out below.

My understanding from the documentation is that all column contents are HTML encoded by default, unless you specify .Encoded(false) on the column.

<% Html.Telerik().Grid(Model)
    .Name("UserGrid")
    .Columns(column =>
        {
            column.Add(x => Html.ImageActionLink("../../Content/Edit.png", "Edit", "Edit", new { id = x.Id })).Width(16);
            column.Add(x => Ajax.ImageActionLink("../../Content/Delete.png", "Delete", "Delete", new { id = x.Id }, new AjaxOptions { Confirm = "Are you sure you wish to delete this user?", HttpMethod = "Delete", UpdateTargetId = "divUserList", OnComplete = "_ajaxOperationComplete" })).Width(16);
            column.Add(x => x.UserName).Title("Username").Encoded(true);
            column.Add(x => x.FullName).Title("Name");
            column.Add(x => x.Email).Title("Email");

        })
        .Sortable()
        .Render();
%>

Unfortunately, this doesn't seem to be occuring.   I've set my database to contain content such as <script>alert(1)</script>, and this is appearing in the output, unencoded, as you can see below.  This happens with .Encoded(true), or leaving the default.

<div id="UserGrid" class="t-widget t-grid">
    <table cellspacing="0">

        <colgroup>
            <col style="width:16px;" /><col style="width:16px;" /><col /><col /><col />
        </colgroup><thead>
            <tr>
                <th class="t-header" scope="col"><a class="t-link" href="/User?UserGrid-orderBy=-asc&amp;UserGrid-page=1"></a></th><th class="t-header" scope="col"><a class="t-link" href="/User?UserGrid-orderBy=-asc&amp;UserGrid-page=1"></a></th><th class="t-header" scope="col"><a class="t-link" href="/User?UserGrid-orderBy=UserName-asc&amp;UserGrid-page=1">Username</a></th><th class="t-header" scope="col"><a class="t-link" href="/User?UserGrid-orderBy=FullName-asc&amp;UserGrid-page=1">Name</a></th><th class="t-header t-last-header" scope="col"><a class="t-link" href="/User?UserGrid-orderBy=Email-asc&amp;UserGrid-page=1">Email</a></th>
            </tr>
        </thead><tfoot>

            <tr>
                <td class="t-footer" colspan="5"><div class="t-status">
                    <a class="t-icon t-refresh" href="#"></a>
                </div></td>
            </tr>
        </tfoot><tbody>
            <tr>
                <td><a href="/User/Edit/9198970c-c467-4fa7-992e-39874edd14b0"><img alt="Edit" src="../../Content/Edit.png" /></a></td><td><a href="/User/Delete/9198970c-c467-4fa7-992e-39874edd14b0" onclick="Sys.Mvc.AsyncHyperlink.handleClick(this, new Sys.UI.DomEvent(event), { insertionMode: Sys.Mvc.InsertionMode.replace, confirm: 'Are you sure you wish to delete this user?', httpMethod: 'Delete', updateTargetId: 'divUserList', onComplete: Function.createDelegate(this, _ajaxOperationComplete) });"><img alt="Delete" src="../../Content/Delete.png" /></a></td><td><script>alert(1)</script></td><td><script>alert(1)</script> <script>alert(1)</script> </td><td>[e-mail]</td>

            </tr><tr class="t-alt">
                <td><a href="/User/Edit/89779a2e-a66c-44f1-8ab0-1a926537612f"><img alt="Edit" src="../../Content/Edit.png" /></a></td><td><a href="/User/Delete/89779a2e-a66c-44f1-8ab0-1a926537612f" onclick="Sys.Mvc.AsyncHyperlink.handleClick(this, new Sys.UI.DomEvent(event), { insertionMode: Sys.Mvc.InsertionMode.replace, confirm: 'Are you sure you wish to delete this user?', httpMethod: 'Delete', updateTargetId: 'divUserList', onComplete: Function.createDelegate(this, _ajaxOperationComplete) });"><img alt="Delete" src="../../Content/Delete.png" /></a></td><td>admin</td><td>Admin User </td><td>[e-mail]</td>
            </tr>
        </tbody>
    </table>
</div>

How can I get the contents automatically encoded?

MVC 1 RTM, Telerik: 2009.3.1223.125

Thanks

[Atanas Korchev]

Hi Salo Corgan,

Indeed you are right. To fix the problem open the Telerik.Web.Mvc/UI/Grid/GridRenderer.cs file and replace this code:
\
if (string.IsNullOrEmpty(column.Format))
{
  Writer.Write(content.ToString());
}

with this
if (string.IsNullOrEmpty(column.Format))
{
     Writer.Write(encode(content.ToString()));
}

Regards,
Atanas Korchev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.

[Salo Corgan]

Thanks for the prompt reply.

Do you know if this is in the Jan release?

[Atanas Korchev]

Hello Salo Corgan,

Yes, this bug is present in the January release as well. I've just checked in the fix however.

Regards,
Atanas Korchev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.

[Salo Corgan]

I'd prefer to stick to the official releases - any idea when the next one will be?

Many thanks.

[Georgi Krustev]

Hello Salo,

The next major release is scheduled for the middle of the March, somewhere between 10.03.2010 and 15.03.2010.

Regards,
Georgi Krustev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.

[Salo Corgan]

Thanks again.

[Jeff Taynton]

Was this issue resolved in the last release?  We still seem to be having an issue relating to the Encoded not working.  For an ajax bound grid with columns including HTML tags they are not being rendered correctly on initial load.  They are only rendered correctly once you try to page or sort the grid.

[Atanas Korchev]

Hello Jeff Taynton,

We need more info in order to reproduce the problem you are describing. I suggest you describe what data is being loaded in the grid and paste the grid and controller declaration here.

Regards,
Atanas Korchev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.

[Joshua Stoddart]

Here is the controller:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using Telerik.Web.Mvc;
using System.ComponentModel;

namespace Controllers
{
    public class Default1Controller : Controller
    {
        public ActionResult Index()
        {
            GridModel<TestViewModel> grid = GetTestGrid(new GridCommand());
            return View("ViewPage1",grid);
        }

        public class TestViewModel
        {
            public string Text { get; set; }
            public string Link { get; set; }
        }

        private IEnumerable<TestViewModel> getTestData()
        {
            List<TestViewModel> data = new List<TestViewModel>();
            data.Add(new TestViewModel { Link = "<a href=\"#\">One</a>", Text = "One" });
            data.Add(new TestViewModel { Link = "<a href=\"#\">Two</a>", Text = "Two" });
            data.Add(new TestViewModel { Link = "<a href=\"#\">Three</a>", Text = "Three" });
            data.Add(new TestViewModel { Link = "<a href=\"#\">Four</a>", Text = "Four" });
            return data.AsEnumerable();
        }


        public GridModel<TestViewModel> GetTestGrid(GridCommand gridCommand)
        {

            IEnumerable<TestViewModel> data = getTestData();
            int total = data.Count();

            foreach (SortDescriptor sortDescriptor in gridCommand.SortDescriptors)
            {
                if (sortDescriptor.SortDirection == ListSortDirection.Ascending)
                {
                    switch (sortDescriptor.Member)
                    {
                        case "Link":
                            data = data.OrderBy(c => c.Link);
                            break;
                        case "Text":
                            data = data.OrderBy(c => c.Text);
                            break;
                    }
                }
                else
                {
                    switch (sortDescriptor.Member)
                    {
                        case "Link":
                            data = data.OrderByDescending(c => c.Link);
                            break;
                        case "Text":
                            data = data.OrderByDescending(c => c.Text);
                            break;
                    }
                }
            }

            if (gridCommand.PageSize > 0)
            {
                data = data.Skip((gridCommand.Page - 1) * gridCommand.PageSize);
            }
            data = data.Take(gridCommand.PageSize);

            GridModel<TestViewModel> grid = new GridModel<TestViewModel> { Data = data, Total = total };
            return grid;
        }



        [GridAction(EnableCustomBinding = true)]
        public ActionResult TestGridAjaxBinding(GridCommand command)
        {
            return View(GetTestGrid(command));
        }

    }
}

Here is the View

<%@ Page Language="C#" Inherits="System.Web.Mvc.ViewPage<Telerik.Web.Mvc.GridModel<Default1Controller.TestViewModel>>" %>

<%@ Import Namespace="Controllers" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>ViewPage1</title>
    <%= Html.RegisterJS("~/Scripts/jquery-1.4.2.min.js")%>
    <%
            Html.Telerik().StyleSheetRegistrar()
                .DefaultGroup(group => group.Add("telerik.common.css")
                                        .Add("telerik.web20.css"))
                .Render();
    %>
</head>
<body>
    <div>

        <%
                Html.Telerik().Grid<Default1Controller.TestViewModel>(Model.Data)
                        .Name("grdTest").Sortable().Pageable(page => page.PageSize(5).Style(GridPagerStyles.NextPrevious).Total(Model.Total))
                        .DataBinding(dataBinding => dataBinding.Ajax().Select("TestGridAjaxBinding", "Default1"))
                        .Columns(columns => {
                            columns.Bound(g => g.Text).Title("Text");
                            columns.Bound(g => g.Link).Title("Link").Encoded(false);
                        })
                        .EnableCustomBinding(true)
                        .Render();
        %>


         <%=Html.Telerik().ScriptRegistrar().jQuery(false) %>

    </div>
</body>
</html>

[Atanas Korchev]

Hello Joshua Stoddart,

This setup is supposed to work. Could you please try the build attached in this support thread?

Sincerely yours,
Atanas Korchev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.

[Joshua Stoddart]

Hi Atanas,

We have tried the build in the thread, but the problem still exists.  It is only on the initial load of the grid, if you do any Ajax binding for refreshing, paging or sorting the encoding works correctly.

Thanks,

Josh Stoddart

[Atanas Korchev]

Hi Joshua Stoddart,

Perhaps the upgrade was not successful as I cannot reproduce the problem. Find attached my test project.

All the best,
Atanas Korchev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.

[Joshua Stoddart]

Hi Atanas,

I think the difference may be that we are using MVC 2 instead of MVC 1, I was unable to run your project as sent due to not having MVC 1 on my machine, however I was able to take your project and update it to be MVC2.  I still see the issue of when the first time the page loads the columns are encoded, then as soon as you perform any Ajax binding the columns are fixed.  Please advise.  I will send or attach the project if you let me know how.

Thank you,

Josh Stoddart

[Atanas Korchev]

Hi Joshua Stoddart,

Indeed changing the version to ASP.NET MVC 2 made a difference.

In ASP.NET MVC 2 the grid is using DisplayFor for displaying fields. However the latter has no notion of the Encoded property of the grid column - it always performs HTML encoding no matter what. I think we should avoid using DisplayFor when Encoded is set to false as we do when the Format property is set. I am logging this for implementation.

You can use the following as a workaround:

columns.Bound(g => g.Link).Title("Link").Encoded(false).Format("{0}");

Regards,
Atanas Korchev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.