bleroy
commented
9 years ago Original comment by Jeffrey Olmstead (Bitbucket: ems, GitHub: ems):
I haven't implemented the unhandled exception in order confirmation yet, but here is the code I am using in PayPal module to strip out invalid characters:
#!c#
public static class CommonService {
// Resource: https://seattlesoftware.wordpress.com/2008/09/11/hexadecimal-value-0-is-an-invalid-character/
public static string SanitizeXmlString(string xml) {
if (xml == null) {
return null;
}
System.Text.StringBuilder buffer = new System.Text.StringBuilder(xml.Length);
foreach (char c in xml) {
if (IsLegalXmlChar(c)) {
buffer.Append(c);
}
}
return buffer.ToString();
}
/// <summary>
/// Whether a given character is allowed by XML 1.0.
/// </summary>
public static bool IsLegalXmlChar(int character) {
return
(
character == 0x9 /* == '\t' == 9 */ ||
character == 0xA /* == '\n' == 10 */ ||
character == 0xD /* == '\r' == 13 */ ||
(character >= 0x20 && character <= 0xD7FF) ||
(character >= 0xE000 && character <= 0xFFFD) ||
(character >= 0x10000 && character <= 0x10FFFF)
);
}
}It is inefficient I am sure iterating over each character... don't see another way though. It does work though so that is a plus. I agree that if it can be deemed to be efficient and working it should make it's way to Nwazet.Commerce and finally to Orchard.Core. Get's me a patch I can put in place for today though.
Originally reported by: Jeffrey Olmstead (Bitbucket: ems, GitHub: ems)
I have a user who has placed an Order via PayPal which feeds back to the Nwazet.Commerce.OrderService.CreateOrder method (so it seems it could also happen in Stripe). This individual is from the country of Lithuania and the street address they provided has an invalid character in it (at least as far as my American keyboard and ultimately XML is concerned). As a result, the following error is thrown:
System.ArgumentException: '', hexadecimal value 0x1A, is an invalid character.
This error stems from:
Nwazet.Commerce.Models.OrderPart.PersistCustomer()
though it could stem from any of these methods. So my question is whether there is a single method / override we can apply to escape the invalid characters.
There is a discussion here: http://stackoverflow.com/questions/8331119/escape-invalid-xml-characters-in-c-sharp about invalid characters. I am wondering if we can use:
SecurityElement.Escape(text); (from System.Security)
to escape all our incoming text and pull these invalid characters out. Could it be implemented at the "ToAttr" method so it is automatically applied against all entries?