3

I want to allow the end-users of my web application to modify views (via web based back office), stored in the database. The desired view engine is expected to be code-injection safe, meaning that the end-user will be limited to the absolute minimum number of expressions available, no server code inserts are allowed.

Is any suitable view engine available to download?

leonard
  • 288
  • 1
  • 5

1 Answers1

2

I don't know of any existing engine, but Phil Haack has a post on storing views in a database: http://haacked.com/archive/2009/04/22/scripted-db-views.aspx

That post deals with the idea of user-created views. If you want to protect against XSS-style code injection attacks, you can sanitize your HTML.

Dave Swersky
  • 34,502
  • 9
  • 78
  • 118
  • As soon I make possible for end-users of my application to modify the views, they can insert server code into the view (for example, if I'd use spark view-engine: by using the syntax like that:

    !{SERVER_CODE_THAT_CAN_DO_ANYTHING_UNSECURE}

    ) So, here I have the security hole right at my web server.     – leonard Mar 31 '10 at 19:58
  • That's what the second link is for- Jeff Atwood himself shows you how to strip out evil stuff up front. Be aware that the server doesn't execute anything itself with ASP.NET MVC. Your primary concern is javascript XSS attacks. – Dave Swersky Mar 31 '10 at 20:01