madskristensen / MiniBlog

A minimal blog engine using Razor Web Pages
Other
917 stars 376 forks source link

Badly escaped HTML makes blank output #153

Open programcsharp opened 9 years ago

programcsharp commented 9 years ago

Not sure why, but if you somehow get a post with badly escaped HTML in the , the blog will return a totally blank page anywhere that post should be displayed. Not an error page, not the chrome around it with a blank post content, but actually no HTML at all.

Here's an example:

<?xml version="1.0" encoding="utf-8"?>
<post>
  <title>Dynamic Linq Aggregate function</title>
  <slug>dynamic-linq-aggregate-function</slug>
  <author></author>
  <pubDate>2014-12-03 14:55:56</pubDate>
  <lastModified>2014-12-03 14:55:56</lastModified>
  <excerpt></excerpt>
  <content>
    // We've tried to find an expression of the type Expression&lt;func&gt;&lt;tsource  , TAcc&gt;&amp;gt;,
    // which is expressed as ( (TSource s) =&amp;gt; s.Price );
  </content>
  <ispublished>true</ispublished>
  <categories>
    <category>Code</category>
  </categories>
  <comments></comments>
</post>
marvc1 commented 9 years ago

I think it is to do with the Html.Raw method not being able to handle invalid Html.

For me, the invalid Html was an additional / in an img element.

The WYSIWYG editor seems to generate invalid HTML every now and again.

codewithtyler commented 9 years ago

@programcsharp I updated the WYSIWYG editor today. Try copying the updated JavaScript file to your website and see if that fixes your issue.

cc: @marvc1

marvc1 commented 9 years ago

@RandomlyKnighted the new wysiwyg editor breaks editing completely for me. The demo environment is also broken.

To recreate the issue here, with the previous wysiwyg editor, paste in anything into the editor and the wysiwyg will generate invalid HTML that crashes the save silently.

E.g paste a plain text:

"Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum."

I think #128 is same bug.

codewithtyler commented 9 years ago

@marvc1 that is my mistake. I accidentally uploaded the wrong editor JS file. Once #181 is approved that should correct the issue you mentioned. Sorry for the inconvenience.