Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for binding to MarkupString values #47718

Closed
1 task done
kzu opened this issue Apr 14, 2023 · 2 comments
Closed
1 task done

Add support for binding to MarkupString values #47718

kzu opened this issue Apr 14, 2023 · 2 comments
Labels
area-blazor Includes: Blazor, Razor Components ✔️ Resolution: By Design Resolved because the behavior in this issue is the intended design.

Comments

@kzu
Copy link

kzu commented Apr 14, 2023

Is there an existing issue for this?

  • I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

It's not possible to bind components to properties of type MarkupString out of the box.

This can be quite convenient when you have fragments of HTML that can be directly bound, although not typically in a bi-directional way?

Describe the solution you'd like

Add a [TypeConverter(typeof(MarkupStringTypeConverter))] to the MarkupString type so that things Just Work.

Additional context

No response
@dotnet-issue-labeler dotnet-issue-labeler bot added the area-blazor Includes: Blazor, Razor Components label Apr 14, 2023
@kzu kzu mentioned this issue Apr 14, 2023
Closed
4 tasks
kzu added a commit to kzu/aspnetcore that referenced this issue Apr 15, 2023
@kzu
Add support for binding to MarkupString values
e9956c3 
It's quite convenient to be able to bind directly to data containing raw HTML. This is quite convoluted to do today, requiring registering a TypeDescriptionProvider, which in turn returns a custom type descriptor which in turn can provide the missing TypeConverter for the desired type.

This adds support out of the box for binding straight to markup strings.

Follows the implementation and tests from dotnet#10730.

Closes dotnet#47718
@javiercn
Copy link
Member

@kzu thanks for contacting us.

Unfortunately, I don't think this is a change we want to take in. MarkupString is considered an "escape hatch" to render markup without HTML encoding it.

As such, we don't think it should be easy to bind inputs into it, as that creates a pit of failure for developers where they can easily introduce XSS vulnerabilities in their app.

@MackinnonBuck MackinnonBuck added the ✔️ Resolution: By Design Resolved because the behavior in this issue is the intended design. label Apr 17, 2023
@MackinnonBuck MackinnonBuck closed this as not planned Won't fix, can't repro, duplicate, stale Apr 17, 2023
@kzu
Copy link
Author

kzu commented Apr 17, 2023

Oh well, I guess my blog post will just get popular then :). For folks coming across this, head over to https://www.cazzulino.com/blazor-markupstring.html

I see your point though.

@dotnet dotnet locked as resolved and limited conversation to collaborators May 17, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
area-blazor Includes: Blazor, Razor Components ✔️ Resolution: By Design Resolved because the behavior in this issue is the intended design.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add support for binding to MarkupString values kzu/aspnetcore
3 participants
@kzu @javiercn @MackinnonBuck