string replacement in page created from template

Question

I've got some aspx pages being created by the user from a template. Included is some string replacement (anyting with ${fieldname}), so a portion of the template looks like this:

<% 
  string title = @"${title}";
%>
<title><%=HttpUtility.HtmlEncode(title) %></title>

When an aspx file is created from this template, the ${title} gets replaced by the value the user entered.

But obviously they can inject arbitrary HTML by just closing the double quote in their input string. How do I get around this? I feel like it should be obvious, but I can't figure a way around this.

I have no control over the template instantiating process -- I need to accept that as a given.

Answer 1

If they include a double quote in their string, that will not inject arbitrary HTML, but arbitrary code, which is even worse.

You can use a regex to filter the input string. I would use an inclusive regex rathern than trying to exclude dangerous chars. Only allow them A-Za-z0-9 and whitespace.

Answer 2

Not sure i understand fully, but...

Try using a regex to strip html from the title instead of html encoding it:

public string StripHTML(string text)
{
    return Regex.Replace(text, @”<(.|\n)*?>”, string.Empty);
}

Is this possible?

<% 
  string title = Regex.Replace(@"${title}", @”<(.|\n)*?>”, string.Empty);
%>

or

<title><%=HttpUtility.HtmlEncode(System.Text.RegularExpressions.Regex.Replace(title, @"<(.|\n)*?>", string.Empty)) %></title>

Answer 3

Take a look at this article...

http://msdn.microsoft.com/en-us/library/a2a4yykt.aspx

Answer 4

Can you store their values in another file(xml maybe) or in a database? That way their input is not compiled into your page. Then you just read the data into variables. Then all you have to worry about is html, which your html encode would take care of.