Setting ASP.NET Core TagHelper Attribute Without Encoding

I want to add the integrity attribute to a script tag in my tag helper. It contains a + sign which I don’t want encoded.

<script integrity="sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7"></script>

This is my tag helper:

[HtmlTargetElement(Attributes = "script")]
public class MyTagHelper : TagHelper
{
    public override async Task ProcessAsync(TagHelperContext context, TagHelperOutput output)
    {
        // Omitted...

        output.Attributes["integrity"] = "sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7";
    }
}

This is the output of the above code, where + has been replaced by &#x2B;:

<script integrity="sha384-Li9vy3DqF8tnTXuiaAJuML3ky&#x2B;er10rcgNR/VqsVpcw&#x2B;ThHmYcwiB1pbOxEbzJr7"></script>

How can I stop this encoding from taking place?

Here is Solutions:

We have many solutions to this problem, But we recommend you to use the first solution because it is tested & true solution that will 100% work for you.

Solution 1

The provided code didn’t work for me, as the ProcessAsync method wasn’t called. There were some things wrong with this (abstract class can’t be instantiated, there is no script attribute etc.).

The solution is basically that you create the TagHelperAttribute class yourself, instead of simply assigning the string type.

@section Scripts {
    <script></script>
}

The tag helper

[HtmlTargetElement("script")]
public class MyTagHelper : TagHelper
{
    public const string IntegrityAttributeName = "integrity";
    public override async Task ProcessAsync(TagHelperContext context, TagHelperOutput output)
    {
        // Omitted...

        output.Attributes[IntegrityAttributeName] = new TagHelperAttribute(IntegrityAttributeName, new HtmlString("sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7"));

        await Task.FromResult(true);
    }
}

This correctly outputs

<script integrity="sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7"></script>

The reason for this is, that TagHelperAttribute has an operator overload public static implicit operator TagHelperAttribute(string value) for the implicit (=) operator, which will create the TagHelperAttribute and pass the string as it’s Value.

In Razor, strings get escaped automatically. If you want to avoid the escaping, you have to use HtmlString instead.

Note: Use and implement solution 1 because this method fully tested our system.
Thank you 🙂

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

Leave a Reply