Skip to content
This repository was archived by the owner on Dec 14, 2018. It is now read-only.

Do not use FormattedModelValue in password editor template #7430

Closed
dougbu wants to merge 2 commits into from
Closed

Do not use FormattedModelValue in password editor template #7430

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb792e9
Do not use `FormattedModelValue` in password editor template
dougbu Mar 2, 2018
848266f
Consolidate tests
dougbu Mar 2, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/Microsoft.AspNetCore.Mvc.ViewFeatures/Internal/DefaultEditorTemplates.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ namespace Microsoft.AspNetCore.Mvc.ViewFeatures.Internal
public static class DefaultEditorTemplates
{
private const string HtmlAttributeKey = "htmlAttributes";
private const string UsePasswordValue = "Switch.Microsoft.AspNetCore.Mvc.UsePasswordValue";

public static IHtmlContent BooleanTemplate(IHtmlHelper htmlHelper)
{
Expand Down Expand Up @@ -312,9 +313,15 @@ public static IHtmlContent ObjectTemplate(IHtmlHelper htmlHelper)

public static IHtmlContent PasswordTemplate(IHtmlHelper htmlHelper)
{
object value = null;
if (AppContext.TryGetSwitch(UsePasswordValue, out var usePasswordValue) && usePasswordValue)
{
value = htmlHelper.ViewData.TemplateInfo.FormattedModelValue;
}

return htmlHelper.Password(
expression: null,
value: htmlHelper.ViewData.TemplateInfo.FormattedModelValue,
value: value,
htmlAttributes: CreateHtmlAttributes(htmlHelper, "text-box single-line password"));
}

Expand Down
49 changes: 49 additions & 0 deletions test/Microsoft.AspNetCore.Mvc.ViewFeatures.Test/Internal/DefaultEditorTemplatesTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -521,6 +521,55 @@ public void MultilineTextTemplate_ReturnsTextArea()
Assert.Equal(expected, HtmlContentUtilities.HtmlContentToString(result));
}

[Fact]
public void PasswordTemplate_ReturnsInputElement_IgnoresValues()
{
// Arrange
var expected = "<input class=\"HtmlEncode[[text-box single-line password]]\" " +
"id=\"HtmlEncode[[FieldPrefix]]\" name=\"HtmlEncode[[FieldPrefix]]\" " +
"type=\"HtmlEncode[[password]]\" />";

// Template ignores Model.
var model = "Model string";

var helper = DefaultTemplatesUtilities.GetHtmlHelper(model);
var viewData = helper.ViewData;
var templateInfo = viewData.TemplateInfo;
templateInfo.HtmlFieldPrefix = "FieldPrefix";

// Template ignores FormattedModelValue, ModelState and ViewData.
templateInfo.FormattedModelValue = "Formatted string";
viewData.ModelState.SetModelValue("FieldPrefix", "Raw model string", "Attempted model string");
viewData["FieldPrefix"] = "ViewData string";

// Act
var result = DefaultEditorTemplates.PasswordTemplate(helper);

// Assert
Assert.Equal(expected, HtmlContentUtilities.HtmlContentToString(result));
}

[Fact]
public void PasswordTemplate_ReturnsInputElement_UsesHtmlAttributes()
Copy link

@NTaylorMullen NTaylorMullen Mar 2, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is really the only test you need. The others aren't directly related to this issue are they?

Copy link
Contributor Author

@dougbu dougbu Mar 3, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, I consolidated the other tests into PasswordTemplate_ReturnsInputElement_IgnoresValues(), setting everything in that. Mixing this one into that test case could be fooled by precedence between the value sources.

{
// Arrange
var expected = "<input class=\"HtmlEncode[[super text-box single-line password]]\" " +
"id=\"HtmlEncode[[FieldPrefix]]\" name=\"HtmlEncode[[FieldPrefix]]\" " +
"type=\"HtmlEncode[[password]]\" value=\"HtmlEncode[[Html attributes string]]\" />";
var helper = DefaultTemplatesUtilities.GetHtmlHelper<string>(model: null);
var viewData = helper.ViewData;
var templateInfo = viewData.TemplateInfo;
templateInfo.HtmlFieldPrefix = "FieldPrefix";

viewData["htmlAttributes"] = new { @class = "super", value = "Html attributes string" };

// Act
var result = DefaultEditorTemplates.PasswordTemplate(helper);

// Assert
Assert.Equal(expected, HtmlContentUtilities.HtmlContentToString(result));
}

[Theory]
[MemberData(nameof(TemplateNameData))]
public void Editor_CallsExpectedHtmlHelper(string templateName, string expectedResult)
Expand Down