views:

78

answers:

2

I load a js variable like this:

var message = '<%= CAnunturi.CPLATA_RAMBURS_INFO %>';

where the static string CPLATA_RAMBURS_INFO i put like:

public static string CPLATA_RAMBURS_INFO = "test";

I use it very well in this method.

 <script type="text/javascript">
    var categoryParam = '<%= CQueryStringParameters.CATEGORY %>';
    var subcategoryParam = '<%= CQueryStringParameters.SUBCATEGORY1_ID %>';
    var message = '<%= CAnunturi.CPLATA_RAMBURS_INFO %>';

    function timedInfo(header) {
        $.jGrowl(message, { header: header });
    };
</script>

so the message appears.

I do not undersand, why, iso of "test", if i take the value from a static method, ths use of message js var is no longer succesfull (the message no longer appears).

public static string CPLATA_RAMBURS_INFO = getRambursInfo();

public static string getRambursInfo()
{
   return System.IO.File.ReadAllText(PathsUtil.getRambursPlataFilePath());
}

EDIT: Source Code:

<script type="text/javascript">
    var categoryParam = 'category';
    var subcategoryParam = 'subcategory1Id';
    var message = 'Lorem ipsum dolor sit amet, eu curabitur venenatis 

viverra pellentesque tortor tempor, nam est suspendisse, aenean vestibulum, suspendisse eget metus aenean at dictum nulla. In luctus, neque porttitor suscipit nibh, aenean ut, commodo velit leo volutpat ullamcorper. ';

    function timedInfo(header) {
        $.jGrowl(message, { header: header });
    };
</script>
+2  A: 

Your file contains special characters (probably a newline or a ') that cause the rendered Javascript to contain a syntax error.

You need to escape the string using the Anti-XSS Toolkit, like this:

var message = '<%= AntiXss.JavaScriptEncode(CAnunturi.CPLATA_RAMBURS_INFO) %>';

EDIT: If AntiXss doesn't help, try the following function:

public static void QuoteString(this string value, StringBuilder b) {
    if (String.IsNullOrEmpty(value))
        return "";

    var b = new StringBuilder();
    int startIndex = 0;
    int count = 0;
    for (int i = 0; i < value.Length; i++) {
        char c = value[i];

        // Append the unhandled characters (that do not require special treament)
        // to the string builder when special characters are detected.
        if (c == '\r' || c == '\t' || c == '\"' || c == '\'' || c == '<' || c == '>' ||
            c == '\\' || c == '\n' || c == '\b' || c == '\f' || c < ' ') {
            if (b == null) {
                b = new StringBuilder(value.Length + 5);
            }

            if (count > 0) {
                b.Append(value, startIndex, count);
            }

            startIndex = i + 1;
            count = 0;
        }

        switch (c) {
            case '\r':
                b.Append("\\r");
                break;
            case '\t':
                b.Append("\\t");
                break;
            case '\"':
                b.Append("\\\"");
                break;
            case '\\':
                b.Append("\\\\");
                break;
            case '\n':
                b.Append("\\n");
                break;
            case '\b':
                b.Append("\\b");
                break;
            case '\f':
                b.Append("\\f");
                break;
            case '\'':
            case '>':
            case '<':
                AppendCharAsUnicode(b, c);
                break;
            default:
                if (c < ' ') {
                    AppendCharAsUnicode(b, c);
                } else {
                    count++;
                }
                break;
        }
    }

    if (b == null) {
        b.Append(value);
    }

    if (count > 0) {
        b.Append(value, startIndex, count);
    }

    return b.ToString();
}
SLaks
I;ve isntalled Axss from microsoft, import this: using Microsoft.Security.Application; but still it does not see it...do you know why?
Cristian Boariu
Please show us the `message` var in the source code.
SLaks
Done............in EDIT
Cristian Boariu
Your string has newlines, which should be escaped by AntiXss.
SLaks
A: 

Try to assign value to your variable in Page_Load() function. I think it'll work.

Artur
That won't work at all. (It's a Javascript variable)
SLaks
I mean this:public static string CPLATA_RAMBURS_INFO;void Page_Load(object sender, EventArgs e){ CPLATA_RAMBURS_INFO = getRambursInfo();}
Artur
That won't help.
SLaks