Finally HtmlEncoding syntax is coming to the databinding tag

In ASP.Net 4 MVC and WebForms, we currently have these two methods for automatically HtmlEncoding output without having to call HttpUtility.HtmlEncode(xxx)

1. @ (Mvc 3 Razor syntax)
2. <%: which both automatically html encode the output to help prevent against XSS (Cross Site Scripting) attacks. This was lacking for data binding syntax for example:

<%# Eval("FirstName") %>

This above syntax had no html encoding and you specifically had to call it

<%# HttpUtility.HtmlEncode((string)Eval("FirstName")) %>

In the future you will be able to just:

<%#: Eval("FirstName") %>

This new syntax will be available in the next version of asp.net (4.1?)

Tech Ed Atlanta 2011 - Hack Proofing your ASP.Net MVC and WebForms Applications

We had a great time at tech ed this year!!
My session on hack proofing is now online - check it out at:
http://channel9.msdn.com/Events/TechEd/NorthAmerica/2011/DEV333

If you watch it, please give it a rating so I know that you enjoyed it : )

MVC - Using Views outside of /Views or other content in /Views

I learned something new recently regarding this subject.
First - to use a View outside of the /Views folder you must put a copy of your web.config from /Views into your new folder. It's that simple.

Secondly - Views by default won't allow other content in them. If you drop a css file in the /Views folder and reference it via http://localhost/views/test.css you will get a 404 file not found error.

If we look in the web.config inside of our views, we have:

<system.web>
    <httpHandlers>
      <add path="*" verb="*" type="System.Web.HttpNotFoundHandler"/>
    </httpHandlers>

This essentially says make any item referenced in /Views (from path="*") a 404 status code - hence file not found. This means you can't address css files, jpegs, etc. - anything inside of /Views.
The workaround is easy though. Simply change the defined handler to exclude ONLY *.cshtml (hence views)

Ideally we probably want to exclude *.cshtml and *.aspx in case we have any web forms view engine code. Unfortunately IIS6 and IIS7 have different syntax here. Changing the web.config in the /Views folder we have:

IIS6:

<system.web>
    <httpHandlers>
      <add path="*.cshtml,*.aspx" verb="*" type="System.Web.HttpNotFoundHandler" />
    </httpHandlers>
  </system.web>

In IIS7:

<system.webServer>
    <handlers>
      <add name="ExcludeRazorViews" path="*.cshtml" verb="*" type="System.Web.HttpNotFoundHandler" />
      <add name="ExcludeWebFormsViews" path="*.aspx" verb="*" type="System.Web.HttpNotFoundHandler" />
    </handlers>
  </system.webServer>

Note also that the web.config in the /Views folder also contains this one as well at the bottom you'll need to watch out for that is provided for IIS 7 compatibility:

    <handlers>
      <remove name="BlockViewHandler"/>
      <add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />
    </handlers>