Skip to content

Commit 4de2973

Browse files
committed
re-add moniker region
1 parent 0d549ce commit 4de2973

1 file changed

Lines changed: 25 additions & 1 deletion

File tree

aspnetcore/security/cross-site-scripting.md

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -246,7 +246,31 @@ builder.Services.AddSingleton<HtmlEncoder>(
246246

247247
:::moniker-end
248248

249-
<!-- OLD moniker section goes here -->
249+
:::moniker range="< aspnetcore-6.0"
250+
251+
You can customize the encoder safe lists to include Unicode ranges appropriate to your application during startup, in `ConfigureServices()`.
252+
253+
For example, using the default configuration you might use a Razor HtmlHelper like so;
254+
255+
```html
256+
<p>This link text is in Chinese: @Html.ActionLink("汉语/漢語", "Index")</p>
257+
```
258+
259+
When you view the source of the web page you'll see it has been rendered as follows, with the Chinese text encoded;
260+
261+
```html
262+
<p>This link text is in Chinese: <a href="/">&#x6C49;&#x8BED;/&#x6F22;&#x8A9E;</a></p>
263+
```
264+
265+
To widen the characters treated as safe by the encoder you would insert the following line into the `ConfigureServices()` method in `startup.cs`;
266+
267+
```csharp
268+
services.AddSingleton<HtmlEncoder>(
269+
HtmlEncoder.Create(allowedRanges: new[] { UnicodeRanges.BasicLatin,
270+
UnicodeRanges.CjkUnifiedIdeographs }));
271+
```
272+
273+
:::moniker-end
250274

251275
This example widens the safe list to include the Unicode Range [CJK Unified Ideographs](https://wikipedia.org/wiki/CJK_Unified_Ideographs). The following output shows the rendered view for the wider range of safe characters:
252276

0 commit comments

Comments
 (0)