Use IHtmlGenerator / TagBuilder in all necessary tag helpers

[SecTex]

Hi,

Is there a reason that some attribute values are not encoded when using abp's tag-helper?
If not, I would like to contribute a PR.

Background:
We want to give the user the opportunity to edit the localized texts. Accordingly, the values should be encoded.

Example:

✔️ Properly encoded

<abp-button button-type="Primary">@L["Edit"].Value</abp-button>

❌ Not encoded

<abp-button button-type="Primary" text="@L["Edit"].Value"></abp-button>

[maliming]

I think this is the behavior of Razor Pages.

[SecTex]

I don't think so.
Another example when using AbpTabLinkTagHelper:

input:

@{ 
    var test = "\"><img src=0 onerror=alert(0)>";
}
<abp-tabs>
    <abp-tab-link title="Link" href="@test"/>
</abp-tabs>

expected result:

<a class="nav-link active" id="...-tab" href="&quot;><img src=0 onerror=alert(0)>">Link</a>

actual result:

<a class="nav-link active" id="...-tab" href=""><img src="0" onerror="alert(0)">"&gt;Link</a>

Therefore I have to encode the value test by myself, while the default tag-helpers handle encoding for me:
input:

@{ 
    var test = "\"><img src=0 onerror=alert(0)>";
}
<a asp-host="@test">Click Me</a>

actual result:

<a href="http://&quot;><img src=0 onerror=alert(0)>">Click Me</a>

[SecTex]

Also, I would like to an fix an issue in jquery-extensions.js.
jQuery's html()-function is used in line 38 and 58. I recommend to use text() instead.

[SecTex]

Hi @maliming,

Is there a reason why you want to use IHtmlGenerator?
Another possibility would be to use the TagBuilder class. For example: e25cd9c

[maliming]

hi @SecTex

I just check the AspNet Core tag helper source code, not depth study. TagBuilder seems fine.