MVC Html.Raw Issue

Darveson Wright

6y8.5k.NET

I need to display emails. I have a list of subjects and each is a link. User clicks on the link and the email displays. The emails are in a SQL table and in HTML format.

The site is a secure https site and when I use Html.Raw to render the html the site's is no longer secure, padlock icon gone and site details indicate contents no longer secure.

How can I render html securely? Is there a safe alternative to Html.Raw.

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Darveson Wright6y ago
Thanks Ram. That produces the same results, security broken. I found a Nuget package, HTML.Sanitize and I process the offending html string in the controller and it works perfectly if the result are not in in a modal popup. When I display result in the popup security is broken even thought the html is santized.
Clicking on a link produces a list of related emails that I show in a modal popup. This might have to do with the use of Url.Action in Javascript
+1

Ramachandran M6y ago

Hi,

Try this

@(new HtmlString(stringWithMarkup))

and you can create a HTML helper too!:

@helper RawText(string s) {
    @(new HtmlString(s))
}