tags:

views:

79

answers:

1
+3  Q: 

Choosing the MVC view engine

I want to allow the end-users of my web application to modify views (via web based back office), stored in the database. The desired view engine is expected to be code-injection safe, meaning that the end-user will be limited to the absolute minimum number of expressions available, no server code inserts are allowed.

Is any suitable view engine available to download?

+2  A: 

I don't know of any existing engine, but Phil Haack has a post on storing views in a database: http://haacked.com/archive/2009/04/22/scripted-db-views.aspx

That post deals with the idea of user-created views. If you want to protect against XSS-style code injection attacks, you can sanitize your HTML.

Dave Swersky  2010-03-31 19:23:43
As soon I make possible for end-users of my application to modify the views, they can insert server code into the view (for example, if I'd use spark view-engine: by using the syntax like that:<p> !{SERVER_CODE_THAT_CAN_DO_ANYTHING_UNSECURE} </p> )So, here I have the security hole right at my web server.
leonard  2010-03-31 19:58:35
That's what the second link is for- Jeff Atwood himself shows you how to strip out evil stuff up front. Be aware that the server doesn't execute anything itself with ASP.NET MVC. Your primary concern is javascript XSS attacks.
Dave Swersky  2010-03-31 20:01:03

related questions

What's the best way to implement field validation using ASP.NET MVC?
How do I handle page flow in MVC (particularly asp.net)
Entity diagrams in ASP.NET MVC
How do I get rid of Home in ASP.Net MVC?
Can I generate ASP.NET MVC routes from a Sitemap?
ASP.NET Model-view-controller (MVC) - where do I start from?
user controls and asp.net mvc
ASP.Net MVC route mapping
RSS Feeds in ASP.NET MVC
Open Source Licensing Options for ASP.NET MVC Application?
Does the OutputCacheFilter in the Microsoft MVC Preview 4 actually save on action invocations?
MVC Learning Resources
Validating posted form data in the ASP.NET MVC framework
Best mock framework that can do both WebForms and MVC?
Use the routing engine for form submissions in ASP.NET MVC Preview 4
How do you get a custom id to render using HtmlHelper in MVC
MVC Preview 4 - No route in the route table matches the supplied values.
Is there a way to include a fragment identifier when using Asp.Net MVC ActionLink, RedirectToAction, etc. ?
In ASP.NET MVC I encounter an incorrect type error when rendering a user control with the correct typed object
ASP.NET MVC - Is it worth it yet?
Multiple languages in an ASP.NET MVC application?
Is it better to create Model classes, or just stick with generic database utility class?
ASP.NET MVC Without Visual Studio
ASP.NET MVC "CRUD" Database Sample
How to RedirectToAction in ASP.NET MVC without losing request data