I’m excited to announce
the June
2012 release
of the Ajax Control Toolkit. You can download
the new release by visiting http://AjaxControlToolkit.CodePlex.com or (better) download
the new release with NuGet:
Install-Package AjaxControlToolkit
The Ajax Control Toolkit continues to be super popular.
The previous release (May 2012) had over 87,000 downloads from CodePlex.com and over 16,000 downloads from NuGet. That’s over 100,000 downloads in less than 2 months.
Security Improvements for
the HtmlEditorExtender
Unfortunately, in
the previous release, we made
the HtmlEditorExtender too secure! We upgraded
the version
of the Microsoft Anti-Cross Site Scripting Library included in
the Ajax Control Toolkit to
the latest version (version 4.2.1) and
the latest version turned out to be way too aggressive about stripping HTML. It not only strips dangerous tags such as <script> tags, it also strips innocent tags such as <b> tags.
When
the latest version
of the Microsoft Anti-Cross Site Scripting Library is used with
the HtmlEditorExtender,
the library strips all rich content from
the HtmlEditorExtender control which defeats
the purpose
of using
the control.
Therefore, we had to find a replacement for
the Microsoft Anti-Cross Site Scripting Library. In this release, we’ve created a new HTML sanitizer built on
the HTML Agility Pack. If you were using
the AntiXssSanitizerProvider then you will need to substitute
the HtmlAgilityPackSanitizerProvider. In particular, you need to modify
the sanitizer sections in your Web.config file like this:
<configuration>
<configSections>
<sectionGroup name="system.web">
<section name="sanitizer" requirePermission="false"
type="AjaxControlToolkit.Sanitizer.ProviderSanitizerSection, AjaxControlToolkit" />
</sectionGroup>
</configSections>
<system.web>
<sanitizer defaultProvider="HtmlAgilityPackSanitizerProvider">
<providers>
<add name="HtmlAgilityPackSanitizerProvider" type="AjaxControlToolkit.Sanitizer.HtmlAgilityPackSanitizerProvider"></add>
</providers>
</sanitizer>
</system.web>
</configuration>
We made one other backwards-breaking change to improve
the security
of the HtmlEditorExtender. We want to make sure that users don’t accidently use
the HtmlEditorExtender without an HTML sanitizer by accident. Therefore, if you don’t configure a HTML sanitizer provider in
the web.config file then you’ll get
the following error:
If you really want to use
the HtmlEditorExtender without using an HTML sanitizer – for example, you are using
the HtmlEditorExtender for an Intranet application and you trust all
of your fellow employees – then you can explicitly indicate that you don’t want to enable HTML sanitization by setting
the EnableSanitization property to false like this:
<ajaxToolkit:HtmlEditorExtender
TargetControlID="txtComments"
EnableSanitization="false"
runat="server" />
Please don’t ever set
the EnableSanitization property to false for a public website. If you disable HTML sanitization then you are making your website an easy target for Cross-Site Scripting attacks.
Lots
of Fixes for
the ComboBox Control
In
the latest release, we also made several important bug fixes and feature enhancements to
the ComboBox control. Here’s
the list
of issues that we fixed:
22930 — ComboBox doesn’t close its drop down list when losing input focus to another ComboBox control
23140 — ComboBox Issues – Delete, Backspace, Period
23142 — ComboxBox SelectedIndex = -1 does not clear text
24440 — ComboBox postback on enter
25295 — ComboBox problems when container is hidden at page load
25469 — ComboBox – MaxLength ignored
26686 — Backspace and Delete exception when optionList is null
27148 — Combobox breaks if ClientIDMode is static
Fixes to Other Controls
In this release, we also made bug fixes and enhancements to
the UpdatePanelAnimation, Tabs, and Seadragon controls:
21310 — OnUpdated animation starts before OnUpdating has finished
26690 — Seadragon Control’s openTileSource() method doesn’t work (with fix) Title is required
We also fixed an issue with
the Tabs control which would result in an InvalidOperation exception.
Summary
I want to thank
the Superexpert team for
the hard work that they put into this release. In particular, I want to thank them for their effort in researching, building, and writing unit tests for
the HtmlAgilityPack HTML sanitizer.
