asp.net - Use ascx as a layout template

Question

This is my layout template (ascx without code behind)

<%@ Control Language="C#" AutoEventWireup="true" Inherits="ws.helpers.LayoutUC" %>
<div>blah blah blah</div>
<ws:Panel runat="server" ID="left"></ws:Panel>
<ws:Panel runat="server" ID="main"></ws:Panel>
<ws:Panel runat="server" ID="right"></ws:Panel>

Modules will be added into ws:Panel later.

I also allow my user create their own ascx file to custom their page layout. And because of this i do a string replace all dangerous part like script tag (runat="server"), all asp.net html tag, <%, <%@, <#.... from their custom.

Im not worry about XSS, so dont comment on it, and ask why?

I want know your thinking about this. Is is safe? Is it scalable? Is it standard or a bad way?

Answer 1

You are allowing user-uploaded content; this is inherently unsafe and there are whole books dedicated to best practices. Given that you are doing it anyway, as long as you make sure you scrub the input, is it scalable? You are allowing creation of user-uploaded files on your site. How many will there be? How many users? What about load-balancing? This solution will not scale for many users, files, or servers.

It sounds like you are trying to create a simple CMS. Why not use one that exists currently, or adopt parts of an open source solution?

Answer 2

Have a look at the INaminingContainer Interface http://msdn.microsoft.com/en-us/library/system.web.ui.inamingcontainer.aspx.

<asp:YourControl>
  <LeftColumn>
    <asp:Literal ID="literal1" runat="server" Text="User created literal" />
  </LeftColumn>
</asp:YourControl>

In the .ascx from the users, they register your control and insert asp.net code into properties. In the 'YourControl' class you create placeholders and insert the markup set to a specific property into these placeholders. (e.g. everything between <LeftColumn> and </LeftColumn> will the inserted into

<asp:Placeholder ID="PlaceholderLeftColumn" runat="server"/>