What does Microsoft.Security.Application.Encoder.UrlPathEncode do?
I found a brilliant example of an HTML sanitizer using HTMLAgilityPack. The code uses the class Microsoft.Security.Application.Encoder
:
// AntiXss
a.Value = Microsoft.Security.Application.Encoder.UrlPathEncode(a.Value);
I cannot find the assembly containing this class, I would rather not have another dependency in my project, and the sanitizer works without this line. Removing this call, however, could lead to a security breach in your code.
To decide for or against using this assembly, I would like to know: what does this method actually do?
source to share
You can see the source code
From the source code of the method
/// <summary>
/// URL-encodes the path section of a URL string and returns the encoded string.
/// </summary>
/// <param name="input">The text to URL path encode</param>
/// <returns>The URL path encoded text.</returns>
[System.Diagnostics.CodeAnalysis.SuppressMessage(
"Microsoft.Design",
"CA1055:UriReturnValuesShouldNotBeStrings",
Justification = "This does not return a full URL so the return type can be a string.")]
public static string UrlPathEncode(string input)
{
if (string.IsNullOrEmpty(input))
{
return input;
}
// DevDiv #211105: We should make the UrlPathEncode method encode only the path portion of URLs.
string schemeAndAuthority;
string path;
string queryAndFragment;
bool validUrl = UriUtil.TrySplitUriForPathEncode(input, out schemeAndAuthority, out path, out queryAndFragment);
if (!validUrl)
{
// treat as a relative URL, so we might still need to chop off the query / fragment components
schemeAndAuthority = null;
UriUtil.ExtractQueryAndFragment(input, out path, out queryAndFragment);
}
return schemeAndAuthority + HtmlParameterEncoder.UrlPathEncode(path, Encoding.UTF8) + queryAndFragment;
}
You will have to dig deeper to get to all the moving parts while coding the uri. Normally I would recommend to explore the unit tests to see what is expected of the component, but at first glance there is no test class Encoder
: (
source to share