System.Text.Encodings.Web 9.0.0-preview.4.24266.19
About
Provides types for encoding and escaping strings for use in JavaScript, HTML, and URLs.
This package is essential for protecting web applications against cross-site scripting (XSS) attacks by safely encoding text, and it offers extensive support for Unicode, allowing fine-grained control over which characters are encoded and which are left unescaped.
Key Features
- Safe encoders for HTML, JavaScript, and URL strings.
- Extensible to support custom encoding scenarios, including the ability to specify Unicode ranges.
- Helps prevent cross-site scripting (XSS) vulnerabilities.
- Flexible Unicode encoding with support for specifying individual or predefined ranges to cover broader sets of characters, including options to avoid escaping specific language character sets.
How to Use
Encoding HTML, JavaScript, and URLs
using System.Text.Encodings.Web;
string unsafeString = "<script>alert('XSS Attack!');</script>";
// HTML encode the string to safely display it on a web page.
string safeHtml = HtmlEncoder.Default.Encode(unsafeString);
Console.WriteLine(safeHtml);
// <script>alert('XSS Attack!');</script>
// JavaScript encode the string to safely include it in a JavaScript context.
string safeJavaScript = JavaScriptEncoder.Default.Encode(unsafeString);
Console.WriteLine(safeJavaScript);
// \u003Cscript\u003Ealert(\u0027XSS Attack!\u0027);\u003C/script\u003E
string urlPart = "user input with spaces and & symbols";
// URL encode the string to safely include it in a URL.
string encodedUrlPart = UrlEncoder.Default.Encode(urlPart);
Console.WriteLine(encodedUrlPart);
// user%20input%20with%20spaces%20and%20%26%20symbols
Custom Encoding Scenario with Specific Unicode Ranges
using System.Text.Encodings.Web;
using System.Text.Unicode;
TextEncoderSettings customEncoderSettings = new TextEncoderSettings();
customEncoderSettings.AllowCharacters('!', '*', '-', '.', '_', '~'); // RFC 3986 unreserved characters
customEncoderSettings.AllowRange(new UnicodeRange('a', 26));
customEncoderSettings.AllowRange(new UnicodeRange('A', 26));
customEncoderSettings.AllowRange(new UnicodeRange('0', 10));
// Create a URL encoder with the custom settings
UrlEncoder customUrlEncoder = UrlEncoder.Create(customEncoderSettings);
string customUrlPart = "custom data: (@123!)";
// By default, the symbols '(', ')', and '@' are not encoded
string defaultEncoded = UrlEncoder.Default.Encode(customUrlPart);
Console.WriteLine(defaultEncoded);
// custom%20data%3A%20(@123!)
// Now, the symbols '(', ')', and '@' are also encoded
string customEncoded = customUrlEncoder.Encode(customUrlPart);
Console.WriteLine(customEncoded);
// custom%20data%3A%20%28%40123!%29
Serialization with Specific Unicode Character Sets
By default Cyrillic characters are encoded as Unicode escape sequences in JSON.
{
"Date": "2019-08-01T00:00:00-07:00",
"TemperatureCelsius": 25,
"Summary": "\u0436\u0430\u0440\u043A\u043E"
}
This can be customized by providing a custom JavaScriptEncoder
to JsonSerializerOptions
:
JsonSerializerOptions options = new JsonSerializerOptions
{
Encoder = JavaScriptEncoder.Create(UnicodeRanges.BasicLatin, UnicodeRanges.Cyrillic),
WriteIndented = true
};
jsonString = JsonSerializer.Serialize(weatherForecast, options1);
{
"Date": "2019-08-01T00:00:00-07:00",
"TemperatureCelsius": 25,
"Summary": "жарко"
}
More information about this can be found in the How to customize character encoding with System.Text.Json article.
Main Types
The main types provided by this library are:
System.Text.Encodings.Web.HtmlEncoder
System.Text.Encodings.Web.JavaScriptEncoder
System.Text.Encodings.Web.UrlEncoder
System.Text.Encodings.Web.TextEncoder
System.Text.Encodings.Web.TextEncoderSettings
System.Text.Unicode.UnicodeRange
System.Text.Unicode.UnicodeRanges
Additional Documentation
Feedback & Contributing
System.Text.Encodings.Web is released as open source under the MIT license. Bug reports and contributions are welcome at the GitHub repository.
Showing the top 20 packages that depend on System.Text.Encodings.Web.
Packages | Downloads |
---|---|
Microsoft.AspNetCore.Http.Abstractions
ASP.NET Core HTTP object model for HTTP requests and responses and also common extension methods for registering middleware in an IApplicationBuilder.
Commonly used types:
Microsoft.AspNetCore.Builder.IApplicationBuilder
Microsoft.AspNetCore.Http.HttpContext
Microsoft.AspNetCore.Http.HttpRequest
Microsoft.AspNetCore.Http.HttpResponse
This package was built from the source code at https://github.com/aspnet/HttpAbstractions/tree/91db78cf926939821bc96e8e60616cf5dde0b489
|
71 |
Azure.Core
This is the implementation of the Azure Client Pipeline
|
62 |
Microsoft.AspNetCore.Html.Abstractions
ASP.NET Core HTML abstractions used for building HTML content.
Commonly used types:
Microsoft.AspNetCore.Html.HtmlString
Microsoft.AspNetCore.Html.IHtmlContent
This package was built from the source code at https://github.com/aspnet/HtmlAbstractions/tree/6c5ca90d81f9013a8652da4c1752bd0b4d18e908
|
62 |
Microsoft.AspNetCore.WebUtilities
ASP.NET Core utilities, such as for working with forms, multipart messages, and query strings.
This package was built from the source code at https://github.com/aspnet/HttpAbstractions/tree/91db78cf926939821bc96e8e60616cf5dde0b489
|
61 |
Microsoft.AspNetCore.WebUtilities
ASP.NET Core utilities, such as for working with forms, multipart messages, and query strings.
|
60 |
Microsoft.AspNetCore.Http.Abstractions
ASP.NET Core HTTP object model for HTTP requests and responses and also common extension methods for registering middleware in an IApplicationBuilder.
Commonly used types:
Microsoft.AspNetCore.Builder.IApplicationBuilder
Microsoft.AspNetCore.Http.HttpContext
Microsoft.AspNetCore.Http.HttpRequest
Microsoft.AspNetCore.Http.HttpResponse
|
60 |
Microsoft.Extensions.WebEncoders
Contains registration and configuration APIs to add the core framework encoders to a dependency injection container.
|
59 |
Azure.Core
This is the implementation of the Azure Client Pipeline
|
58 |
Microsoft.AspNetCore.WebUtilities
ASP.NET Core utilities, such as for working with forms, multipart messages, and query strings.
This package was built from the source at:
https://github.com/aspnet/HttpAbstractions/tree/14076d94c38960787772ea7999c7aa159afbba2b
|
58 |
Microsoft.AspNetCore.WebUtilities
ASP.NET Core utilities, such as for working with forms, multipart messages, and query strings.
|
57 |
Microsoft.AspNetCore.Http.Abstractions
ASP.NET Core HTTP object model for HTTP requests and responses and also common extension methods for registering middleware in an IApplicationBuilder.
Commonly used types:
Microsoft.AspNetCore.Builder.IApplicationBuilder
Microsoft.AspNetCore.Http.HttpContext
Microsoft.AspNetCore.Http.HttpRequest
Microsoft.AspNetCore.Http.HttpResponse
|
56 |
System.Text.Json
Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in. Also provides types to read and write JSON text encoded as UTF-8, and to create an in-memory document object model (DOM), that is read-only, for random access of the JSON elements within a structured view of the data.
Commonly Used Types:
System.Text.Json.JsonSerializer
System.Text.Json.JsonDocument
System.Text.Json.JsonElement
System.Text.Json.Utf8JsonWriter
System.Text.Json.Utf8JsonReader
|
55 |
Microsoft.AspNetCore.Http.Abstractions
ASP.NET Core HTTP object model for HTTP requests and responses and also common extension methods for registering middleware in an IApplicationBuilder.
Commonly used types:
Microsoft.AspNetCore.Builder.IApplicationBuilder
Microsoft.AspNetCore.Http.HttpContext
Microsoft.AspNetCore.Http.HttpRequest
Microsoft.AspNetCore.Http.HttpResponse
|
55 |
Microsoft.AspNetCore.Html.Abstractions
ASP.NET Core HTML abstractions used for building HTML content.
Commonly used types:
Microsoft.AspNetCore.Html.HtmlString
Microsoft.AspNetCore.Html.IHtmlContent
|
55 |
Microsoft.AspNetCore.Html.Abstractions
ASP.NET Core HTML abstractions used for building HTML content.
Commonly used types:
Microsoft.AspNetCore.Html.HtmlString
Microsoft.AspNetCore.Html.IHtmlContent
|
54 |
System.Text.Json
Provides high-performance and low-allocating types that serialize objects to JavaScript Object Notation (JSON) text and deserialize JSON text to objects, with UTF-8 support built-in. Also provides types to read and write JSON text encoded as UTF-8, and to create an in-memory document object model (DOM), that is read-only, for random access of the JSON elements within a structured view of the data.
Commonly Used Types:
System.Text.Json.JsonSerializer
System.Text.Json.JsonDocument
System.Text.Json.JsonElement
System.Text.Json.Utf8JsonWriter
System.Text.Json.Utf8JsonReader
|
54 |
Microsoft.Extensions.WebEncoders
Contains registration and configuration APIs to add the core framework encoders to a dependency injection container.
|
54 |
Microsoft.Extensions.WebEncoders
Contains registration and configuration APIs to add the core framework encoders to a dependency injection container.
|
53 |
Microsoft.Extensions.WebEncoders
Contains registration and configuration APIs to add the core framework encoders to a dependency injection container.
This package was built from the source at:
https://github.com/aspnet/HtmlAbstractions/tree/8d5b123c611a6df427624e5c7499f14061646577
|
53 |
.NET Framework 4.6.2
- System.Buffers (>= 4.5.1)
- System.Memory (>= 4.5.5)
- System.Runtime.CompilerServices.Unsafe (>= 6.0.0)
.NET 8.0
- No dependencies.
.NET 9.0
- No dependencies.
.NET Standard 2.0
- System.Buffers (>= 4.5.1)
- System.Memory (>= 4.5.5)
- System.Runtime.CompilerServices.Unsafe (>= 6.0.0)