huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

HtmlEncode all user input in Azure OpenID sample

This commit is contained in:
Troy Dai 2016-08-22 22:30:11 -07:00
parent 7ea76f5e54
commit 62f0f6e857
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
samples/OpenIdConnect.AzureAdSample/Startup.cs
View File

@ -157,7 +157,7 @@ namespace OpenIdConnect.AzureAdSample
string userObjectID = context.User.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value; string userObjectID = context.User.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
var result = await authContext.AcquireTokenSilentAsync(resource, credential, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId)); var result = await authContext.AcquireTokenSilentAsync(resource, credential, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));
await response.WriteAsync($"<h3>access_token</h3><code>{result.AccessToken}</code><br>"); await response.WriteAsync($"<h3>access_token</h3><code>{HtmlEncode(result.AccessToken)}</code><br>");
} }
catch (Exception ex) catch (Exception ex)
{ {
@ -184,7 +184,7 @@ namespace OpenIdConnect.AzureAdSample
await response.WriteAsync("<tr>"); await response.WriteAsync("<tr>");
foreach (var column in columns) foreach (var column in columns)
{ {
await response.WriteAsync($"<th>{column}</th>"); await response.WriteAsync($"<th>{HtmlEncode(column)}</th>");
} }
await response.WriteAsync("</tr>"); await response.WriteAsync("</tr>");
foreach (var row in data) foreach (var row in data)
@ -192,7 +192,7 @@ namespace OpenIdConnect.AzureAdSample
await response.WriteAsync("<tr>"); await response.WriteAsync("<tr>");
foreach (var column in row) foreach (var column in row)
{ {
await response.WriteAsync($"<td>{column}</td>"); await response.WriteAsync($"<td>{HtmlEncode(column)}</td>");
} }
await response.WriteAsync("</tr>"); await response.WriteAsync("</tr>");
} }