The July 2011 release of the
Ajax Control Toolkit includes a new, lightweight, HTML5 compatible HTML Editor extender. In this blog entry, I explain
how you can take advantage of NuGet
to quickly add the new HTML Editor control extender
to a new or existing ASP.NET Web Forms application. Installing the Latest Version of the
Ajax Control Toolkit with NuGet NuGet is a package manager. It enables you
to quickly install new software directly from within Visual Studio 2010. You can
use NuGet
to install additional software when building any type of .NET application including ASP.NET Web Forms and ASP.NET MVC applications. If you have not already installed NuGet then you can install NuGet by navigating
to the following address and clicking the giant install button: http://nuget.org/ After you install NuGet, you can add the
Ajax Control Toolkit
to a new or existing ASP.NET Web Forms application by selecting the Visual Studio menu option Tools, Library Package Manager, Package Manager Console: Selecting this menu option opens the Package Manager Console. You can enter the command Install-Package AjaxControlToolkit in the console
to install the
Ajax Control Toolkit: After you install the
Ajax Control Toolkit with NuGet, your application will include an assembly reference
to the AjaxControlToolkit.dll and SanitizerProviders.dll assemblies: Furthermore, your Web.config file will be updated
to contain a new tag prefix for the
Ajax Control Toolkit controls: <configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
<pages>
<controls>
<add tagPrefix="ajaxToolkit" assembly="AjaxControlToolkit" namespace="AjaxControlToolkit" />
</controls>
</pages>
</system.web>
</configuration>
The configuration file installed by NuGet adds the prefix ajaxToolkit for all of the
Ajax Control Toolkit controls. You can type ajaxToolkit: in source view
to get auto-complete in Source view. You can, of course, change this prefix
to anything you want.
Using the HTML Editor Extender
After you install the
Ajax Control Toolkit, you can
use the HTML Editor Extender with the standard ASP.NET TextBox control
to enable users
to enter rich formatting such as bold, underline, italic, different fonts, and different background and foreground colors.
For example, the following page can be used for entering comments. The page contains a standard ASP.NET TextBox, Button, and Label control. When you click the button, any text entered into the TextBox is displayed in the Label control. It is a pretty boring page:
Let’s make this page fancier by extending the standard ASP.NET TextBox with the HTML Editor extender control:
Notice that the ASP.NET TextBox now has a toolbar which includes buttons for performing various kinds of formatting. For example, you can change the size and font used for the text. You also can change the foreground and background color – and make many other formatting changes.
You can customize the toolbar buttons which the HTML Editor extender displays.
To learn
how to customize the toolbar, see the HTML Editor Extender sample page here:
http://www.asp.net/ajaxLibrary/AjaxControlToolkitSampleSite/HTMLEditorExtender/HTMLEditorExtender.aspx
Here’s the source code for the ASP.NET page:
<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="WebApplication1.Default" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Add Comments</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<ajaxToolkit:ToolkitScriptManager
ID="TSM1"
runat="server" />
<asp:TextBox
ID="txtComments"
TextMode="MultiLine"
Columns="50"
Rows="8"
Runat="server" />
<ajaxToolkit:HtmlEditorExtender
ID="hee"
TargetControlID="txtComments"
Runat="server" />
<br /><br />
<asp:Button
ID="btnSubmit"
Text="Add Comment"
Runat="server" onclick="btnSubmit_Click" />
<hr />
<asp:Label
ID="lblComment"
Runat="server" />
</div>
</form>
</body>
</html>
Notice that the page above contains 5 controls. The page contains a standard ASP.NET TextBox, Button, and Label control. However, the page also contains an
Ajax Control Toolkit ToolkitScriptManager control and HtmlEditorExtender control.
The HTML Editor extender control extends the standard ASP.NET TextBox control. The HTML Editor TargetID attribute points at the TextBox control.
Here’s the code-behind for the page above:
using System;
namespace WebApplication1 {
public partial class Default : System.Web.UI.Page {
protected void btnSubmit_Click(object sender, EventArgs e) {
lblComment.Text = txtComments.Text;
}
}
}
Preventing XSS/JavaScript Injection Attacks
If you
use an HTML Editor -- any HTML Editor -- in a public facing web page then you are opening your website up
to Cross-Site Scripting (XSS) attacks. An evil hacker could submit HTML using the HTML Editor which contains JavaScript that steals private information such as other user’s passwords.
Imagine, for example, that you create a web page which enables your customers
to post comments about your website. Furthermore, imagine that you decide
to redisplay the comments so every user can see them. In that case, a malicious user could submit JavaScript which displays a dialog asking for a user name and password. When an unsuspecting customer enters their secret password, the script could transfer the password
to the hacker’s website.
So
how do you accept HTML content without opening your website up
to JavaScript injection attacks? The
Ajax Control Toolkit HTML Editor supports the Anti-XSS library. You can
use the Anti-XSS library
to sanitize any HTML content. The Anti-XSS library, for example, strips away all JavaScript automatically.
You can download the Anti-XSS library from NuGet. Open the Package Manager Console and execute the command Install-Package AntiXSS:
Adding the Anti-XSS library
to your application adds two assemblies
to your application named AntiXssLibrary.dll and HtmlSanitizationLibrary.dll.
After you install the Anti-XSS library, you can configure the HTML Editor extender
to use the Anti-XSS library your application’s web.config file:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<configSections>
<sectionGroup name="system.web">
<section name="sanitizer" requirePermission="false" type="AjaxControlToolkit.Sanitizer.ProviderSanitizerSection, AjaxControlToolkit"/>
</sectionGroup>
</configSections>
<system.web>
<sanitizer defaultProvider="AntiXssSanitizerProvider">
<providers>
<add name="AntiXssSanitizerProvider"
type="AjaxControlToolkit.Sanitizer.AntiXssSanitizerProvider"></add>
</providers>
</sanitizer>
<compilation debug="true" targetFramework="4.0" />
<pages>
<controls>
<add tagPrefix="ajaxToolkit" assembly="AjaxControlToolkit" namespace="AjaxControlToolkit" />
</controls>
</pages>
</system.web>
</configuration>
Summary
In this blog entry, I described
how you can quickly get started using the new HTML Editor extender – included with the July 2011 release of the
Ajax Control Toolkit – by installing the
Ajax Control Toolkit with NuGet. If you want
to learn more about the HTML Editor then please take a look at the
Ajax Control Toolkit sample site:
http://www.asp.net/ajaxLibrary/AjaxControlToolkitSampleSite/HTMLEditorExtender/HTMLEditorExtender.aspx
