Clean Text in FCKeditor textbox

Question

I have a legacy web application that I'm needing to migrate to a new Windows Server (to 2019 from 2008r2) and have been running into some security issues. mainly with a rich text style textbox FCKeditor text box. this editor adds html tags and if somebody copies from a Word doc to fill out the field, the hidden Word doc structures (xml and style content) is also brought over and thus the 2019 security throws an error message about the text being potentially hazardous. I came up with a function to clean up the text content and bring it back to a plain text content. however the security still throws an error and never makes it to the function i created.

protected string GetCleanedText(string content)
{

    const string tagWhiteSpace = @"(>|$)(\W|
|
)+<"; 
    const string stripFormatting = @"<[^>]*(>|$)"; 
    const string lineBreak = @"<(br|BR)\s{0,1}/{0,1}>";
    const string xmlformatting = @"[\s\S]*?";
    const string styleformatting = @"";
    Regex lineBreakRegex = new Regex(lineBreak, RegexOptions.Multiline);
    Regex xmlformattingRegex = new Regex(xmlformatting, RegexOptions.Multiline);
    Regex stripFormattingRegex = new Regex(stripFormatting, RegexOptions.Multiline);
    Regex tagWhiteSpaceRegex = new Regex(tagWhiteSpace, RegexOptions.Multiline);
    Regex styleformattingRegex = new Regex(styleformatting, RegexOptions.Multiline);

    string text = content;
    //xml formatting
    text = xmlformattingRegex.Replace(text, string.Empty);
    //style formatting
    text = styleformattingRegex.Replace(text, string.Empty);
    //Decode html specific characters
    //text = System.Net.WebUtility.HtmlDecode(text);
    //text = System.Net.WebUtility.HtmlDecode(text);
    text = System.Web.HttpUtility.HtmlDecode(text);
    //Remove tag whitespace/line breaks
    text = tagWhiteSpaceRegex.Replace(text, "><");
    //Replace 
 with line breaks
    text = lineBreakRegex.Replace(text, Environment.NewLine);
    //Strip formatting
    text = stripFormattingRegex.Replace(text, string.Empty);

    return text;
}

The data on the aspx page is set up with two way binding via Bind(). I've tried replacing it with Eval() and calling theGetCleanedText() function to clean the text content, but the data continues to get wiped due to the FormView1_ItemCreated() function and either leaves the text box empty or doesn't allow the content to be updated. I've also tried to implement stuff in the ItemCreated, ItemUpdating, and FormView1_DataBound() functions and still either get an emtpy text box or one that when Editing the text field doesn't maintain the new text content.

here's the aspx page (I've removed most of the other content to focus on what I'm trying to fix):


                            
                
                    
                                        
                                            Business Reason for the Purchase:

                                            
                                            
                                        
                                        
                                             
                                        
                                        
                                            Description of Product or Service:

                                            
                                            
                                        
                                    
                                    
                                        
                                            
                                             
                                            
                                        
                                        
                                             
                                        
                                        
                                             
                                        
                                        
                                        
                                    
                
                
                            
                                
                                    
                                        
                                            Business Reason for the Purchase:

                                            
                                            
                                        
                                        
                                             
                                        
                                        
                                            Description of Product or Service:

                                            
                                            
                                        
                                    
                                    
                                        
                                            
                                             
                                            
                                        
                                        
                                             
                                        
                                        
                                             
                                        
                                        
                                        
                                    
                                
                            
                            
                                
                                    
                                        
                                            Business Reason for the Purchase:

                                            
                                        
                                    
                                    
                                        
                                            Description of Product or Service:

and here's the C# code behind page:


protected void FormView1_DataBound(object sender, EventArgs e)
{
    // databinding for things that weren't set up with Bind()
    //  does not have any content for the purchase_reasonTextBox or product_descriptionTextBox
}
protected void FormView1_ItemCreated(object sender, EventArgs e)
    {
        FormViewRow row = FormView1.Row;
        if (FormView1.CurrentMode == FormViewMode.Edit || FormView1.CurrentMode == FormViewMode.Insert)
        {
            //initialize
            if (FormView1.CurrentMode == FormViewMode.Insert)
            {
                // nothing relevant
            }
            else if (FormView1.CurrentMode == FormViewMode.Edit)
            {
                //nothing relevant
            }

            FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
            if (purchase_reasonTextBox != null)
            {
                purchase_reasonTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
                purchase_reasonTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
                purchase_reasonTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
            }

            FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
            if (product_descriptionTextBox != null)
            {
                product_descriptionTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
                product_descriptionTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
                product_descriptionTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
            }
        }
    }
    protected void FormView1_ItemUpdating(object sender, FormViewUpdateEventArgs e)
    {
        FormViewRow row = FormView1.Row;
        if (FormView1.CurrentMode == FormViewMode.Edit)
        {
        //nothing relevant
        }
    }

I'm running out of ideas for how to work around this issue. I Have to clean the content, and I'm not allowed to edit the database directly.

here's the last set of changes I tried:

protected void FormView1_DataBound(object sender, EventArgs e)
{
    FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
    if (purchase_reasonTextBox != null)
    {
        purchase_reasonTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
        purchase_reasonTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
        purchase_reasonTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
    }
    purchase_reasonTextBox.Value = GetCleanedText(rowView["purchase_reason"].ToString());
    FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
    if (product_descriptionTextBox != null)
    {
        product_descriptionTextBox.CustomConfigurationsPath = Request.ApplicationPath + "/include/fckconfig.js";
        product_descriptionTextBox.EditorAreaCSS = Request.ApplicationPath + "/App_Themes/FrontTheme/Style.css";
        product_descriptionTextBox.StylesXmlPath = Request.ApplicationPath + "/include/fckstyles.xml";
    }
    product_descriptionTextBox.Value = GetCleanedText(rowView["product_description"].ToString());
}
protected void FormView1_ItemUpdating(object sender, FormViewUpdateEventArgs e)
{
        FormViewRow row = FormView1.Row;
        if (FormView1.CurrentMode == FormViewMode.Edit)
        {
            FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
            e.NewValues["purchase_reason"] = purchase_reasonTextBox.Value; //GetCleanedText(purchase_reasonTextBox.Value);
            FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
            e.NewValues["product_description"] = product_descriptionTextBox.Value; //GetCleanedText(product_descriptionTextBox.Value);
        }
}

protected void FormView1_ItemInserting(object sender, FormViewInsertEventArgs e)
{
        Response.Write("  --  Item Inserting --  ");
        FormViewRow row = FormView1.Row;
        if (FormView1.CurrentMode == FormViewMode.Insert)
        {
            FredCK.FCKeditorV2.FCKeditor purchase_reasonTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("purchase_reasonTextBox");
            e.Values["purchase_reason"] = GetCleanedText(purchase_reasonTextBox.Value);
            FredCK.FCKeditorV2.FCKeditor product_descriptionTextBox = (FredCK.FCKeditorV2.FCKeditor)row.FindControl("product_descriptionTextBox");
            e.Values["product_description"] = GetCleanedText(product_descriptionTextBox.Value);
    }
}

I would appreciate any advice on how to get the text content inside of the text boxes returned to plain text

Clean Text in FCKeditor textbox

Answers (1)

Related Questions