Skip to content

Commit 9d0e1e4

Browse files
hakenrhakenr
authored
DynamicComponents - vulnerability fix (dotnet#256)
1 parent 342894b commit 9d0e1e4

24 files changed

+584
-782
lines changed

‎6.0/BlazorSample_Server/ComponentMetadata.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
public class ComponentMetadata
1+
public class ComponentMetadata
22
{
3-
public string? Name { get; set; }
4-
public Dictionary<string, object> Parameters { get; set; } =
5-
new Dictionary<string, object>();
3+
public Type? Type { get; init; }
4+
public string? Name { get; init; }
5+
public Dictionary<string, object> Parameters { get; } = new();
66
}

‎6.0/BlazorSample_Server/Pages/dynamiccomponent/DynamicComponentExample1.razor‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
Select your transport:
88
<select @onchange="OnDropdownChange">
99
<option value="">Select a value</option>
10-
<option value="@nameof(RocketLab)">Rocket Lab</option>
11-
<option value="@nameof(SpaceX)">SpaceX</option>
12-
<option value="@nameof(UnitedLaunchAlliance)">ULA</option>
13-
<option value="@nameof(VirginGalactic)">Virgin Galactic</option>
10+
@foreach (var entry in components.Keys)
11+
{
12+
<option value="@entry">@entry</option>
13+
}
1414
</select>
1515
</label>
1616
</p>
@@ -23,16 +23,24 @@
2323
}
2424

2525
@code {
26+
private readonly Dictionary<string, Type> components = new()
27+
{
28+
["Rocket Lab"] = typeof(RocketLab),
29+
["SpaceX"] = typeof(SpaceX),
30+
["ULA"] = typeof(UnitedLaunchAlliance),
31+
["Virgin Galactic"] = typeof(VirginGalactic)
32+
};
2633
private Type? selectedType;
2734

2835
private void OnDropdownChange(ChangeEventArgs e)
2936
{
30-
/*
31-
IMPORTANT!
32-
Change "BlazorSample.Shared.dynamiccomponent" to match
33-
your shared component's namespace in the Type.GetType() argument.
34-
*/
35-
selectedType = e.Value?.ToString()?.Length > 0 ?
36-
Type.GetType($"BlazorSample.Shared.dynamiccomponent.{e.Value}") : null;
37+
if ((e.Value is string dropdownValue) && !String.IsNullOrWhiteSpace(dropdownValue))
38+
{
39+
selectedType = components[dropdownValue];
40+
}
41+
else
42+
{
43+
selectedType = null;
44+
}
3745
}
3846
}

‎6.0/BlazorSample_Server/Pages/dynamiccomponent/DynamicComponentExample2.razor‎

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -22,40 +22,41 @@
2222
</label>
2323
</p>
2424

25-
@if (selectedType is not null)
25+
@if (selectedComponent is not null)
2626
{
2727
<div class="border border-primary my-1 p-1">
28-
<DynamicComponent Type="selectedType"
29-
Parameters="components[selectedType.Name].Parameters" />
28+
<DynamicComponent Type="selectedComponent.Type"
29+
Parameters="selectedComponent.Parameters" />
3030
</div>
3131
}
3232

3333
@code {
3434
private Dictionary<string, ComponentMetadata> components =
3535
new()
3636
{
37+
[nameof(RocketLabWithWindowSeat)] = new ComponentMetadata()
3738
{
38-
"RocketLabWithWindowSeat",
39-
new ComponentMetadata
40-
{
41-
Name = "Rocket Lab with Window Seat",
42-
Parameters = new() { { "WindowSeat", false } }
43-
}
39+
Type = typeof(RocketLabWithWindowSeat),
40+
Name = "Rocket Lab with Window Seat",
41+
Parameters = { [nameof(RocketLabWithWindowSeat.WindowSeat)] = false }
4442
},
43+
[nameof(VirginGalactic)] = new ComponentMetadata()
4544
{
46-
"VirginGalactic",
47-
new ComponentMetadata { Name = "Virgin Galactic" }
45+
Type = typeof(VirginGalactic),
46+
Name = "Virgin Galactic"
4847
},
48+
[nameof(UnitedLaunchAlliance)] = new ComponentMetadata()
4949
{
50-
"UnitedLaunchAlliance",
51-
new ComponentMetadata { Name = "ULA" }
50+
Type = typeof(UnitedLaunchAlliance),
51+
Name = "ULA"
5252
},
53+
[nameof(SpaceX)] = new ComponentMetadata()
5354
{
54-
"SpaceX",
55-
new ComponentMetadata { Name = "SpaceX" }
55+
Type = typeof(SpaceX),
56+
Name = "SpaceX"
5657
}
5758
};
58-
private Type? selectedType;
59+
private ComponentMetadata? selectedComponent;
5960
private bool windowSeat;
6061

6162
private bool WindowSeat
@@ -64,19 +65,20 @@
6465
set
6566
{
6667
windowSeat = value;
67-
components[nameof(RocketLabWithWindowSeat)].Parameters["WindowSeat"] =
68-
windowSeat;
68+
components[nameof(RocketLabWithWindowSeat)]
69+
.Parameters[nameof(RocketLabWithWindowSeat.WindowSeat)] = windowSeat;
6970
}
7071
}
7172

7273
private void OnDropdownChange(ChangeEventArgs e)
7374
{
74-
/*
75-
IMPORTANT!
76-
Change "BlazorSample.Shared.dynamiccomponent" to match
77-
your shared component's namespace in the Type.GetType() argument.
78-
*/
79-
selectedType = e.Value?.ToString()?.Length > 0 ?
80-
Type.GetType($"BlazorSample.Shared.dynamiccomponent.{e.Value}") : null;
75+
if ((e.Value is string dropdownValue) && !String.IsNullOrWhiteSpace(dropdownValue))
76+
{
77+
selectedComponent = components[dropdownValue];
78+
}
79+
else
80+
{
81+
selectedComponent = null;
82+
}
8183
}
8284
}

‎6.0/BlazorSample_Server/Pages/dynamiccomponent/DynamicComponentExample3.razor‎

Lines changed: 46 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,19 @@
77
Select your transport:
88
<select @onchange="OnDropdownChange">
99
<option value="">Select a value</option>
10-
<option value="@nameof(RocketLab2)">Rocket Lab</option>
11-
<option value="@nameof(SpaceX2)">SpaceX</option>
12-
<option value="@nameof(UnitedLaunchAlliance2)">ULA</option>
13-
<option value="@nameof(VirginGalactic2)">Virgin Galactic</option>
10+
@foreach (var c in Components)
11+
{
12+
<option value="@c.Key">@c.Value.Name</option>
13+
}
1414
</select>
1515
</label>
1616
</p>
1717

18-
@if (selectedType is not null)
18+
@if (selectedComponent is not null)
1919
{
2020
<div class="border border-primary my-1 p-1">
21-
<DynamicComponent Type="selectedType"
22-
Parameters="Components[selectedType.Name].Parameters" />
21+
<DynamicComponent Type="selectedComponent.Type"
22+
Parameters="selectedComponent.Parameters" />
2323
</div>
2424
}
2525

@@ -28,92 +28,52 @@
2828
</p>
2929

3030
@code {
31-
private Type? selectedType;
31+
private ComponentMetadata? selectedComponent;
3232
private string? message;
3333

34-
private Dictionary<string, ComponentMetadata> Components
35-
{
36-
get
34+
private Dictionary<string, ComponentMetadata> Components =>
35+
new()
3736
{
38-
return new Dictionary<string, ComponentMetadata>()
37+
[nameof(RocketLab2)] = new ComponentMetadata()
3938
{
40-
{
41-
"RocketLab2",
42-
new ComponentMetadata
43-
{
44-
Name = "Rocket Lab",
45-
Parameters =
46-
new()
47-
{
48-
{
49-
"OnClickCallback",
50-
EventCallback.Factory.Create<MouseEventArgs>(
51-
this, ShowDTMessage)
52-
}
53-
}
54-
}
55-
},
56-
{
57-
"VirginGalactic2",
58-
new ComponentMetadata
59-
{
60-
Name = "Virgin Galactic",
61-
Parameters =
62-
new()
63-
{
64-
{
65-
"OnClickCallback",
66-
EventCallback.Factory.Create<MouseEventArgs>(
67-
this, ShowDTMessage)
68-
}
69-
}
70-
}
71-
},
72-
{
73-
"UnitedLaunchAlliance2",
74-
new ComponentMetadata
75-
{
76-
Name = "ULA",
77-
Parameters =
78-
new()
79-
{
80-
{
81-
"OnClickCallback",
82-
EventCallback.Factory.Create<MouseEventArgs>(
83-
this, ShowDTMessage)
84-
}
85-
}
86-
}
87-
},
88-
{
89-
"SpaceX2",
90-
new ComponentMetadata
91-
{
92-
Name = "SpaceX",
93-
Parameters =
94-
new()
95-
{
96-
{
97-
"OnClickCallback",
98-
EventCallback.Factory.Create<MouseEventArgs>(
99-
this, ShowDTMessage)
100-
}
101-
}
102-
}
103-
}
104-
};
105-
}
106-
}
39+
Type = typeof(RocketLab2),
40+
Name = "Rocket Lab",
41+
Parameters = { [nameof(RocketLab2.OnClickCallback)] =
42+
EventCallback.Factory.Create<MouseEventArgs>(this, ShowDTMessage) }
43+
},
44+
[nameof(VirginGalactic2)] = new ComponentMetadata()
45+
{
46+
Type = typeof(VirginGalactic2),
47+
Name = "Virgin Galactic",
48+
Parameters = { [nameof(VirginGalactic2.OnClickCallback)] =
49+
EventCallback.Factory.Create<MouseEventArgs>(this, ShowDTMessage) }
50+
},
51+
[nameof(UnitedLaunchAlliance2)] = new ComponentMetadata()
52+
{
53+
Type = typeof(UnitedLaunchAlliance2),
54+
Name = "ULA",
55+
Parameters = { [nameof(UnitedLaunchAlliance2.OnClickCallback)] =
56+
EventCallback.Factory.Create<MouseEventArgs>(this, ShowDTMessage) }
57+
},
58+
[nameof(SpaceX2)] = new ComponentMetadata()
59+
{
60+
Type = typeof(SpaceX2),
61+
Name = "SpaceX",
62+
Parameters = { [nameof(SpaceX2.OnClickCallback)] =
63+
EventCallback.Factory.Create<MouseEventArgs>(this, ShowDTMessage) }
64+
}
65+
};
10766

10867
private void OnDropdownChange(ChangeEventArgs e)
10968
{
110-
/*
111-
IMPORTANT!
112-
Change "BlazorSample.Shared.dynamiccomponent" to match
113-
your shared component's namespace in the Type.GetType() argument.
114-
*/
115-
selectedType = e.Value?.ToString()?.Length > 0 ?
116-
Type.GetType($"BlazorSample.Shared.dynamiccomponent.{e.Value}") : null;
69+
if ((e.Value is string dropdownValue) && !String.IsNullOrWhiteSpace(dropdownValue))
70+
{
71+
selectedComponent = Components[dropdownValue];
72+
}
73+
else
74+
{
75+
selectedComponent = null;
76+
}
11777
}
11878

11979
private void ShowDTMessage(MouseEventArgs e) =>

‎6.0/BlazorSample_WebAssembly/ComponentMetadata.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
public class ComponentMetadata
1+
public class ComponentMetadata
22
{
3-
public string? Name { get; set; }
4-
public Dictionary<string, object> Parameters { get; set; } =
5-
new Dictionary<string, object>();
3+
public Type? Type { get; init; }
4+
public string? Name { get; init; }
5+
public Dictionary<string, object> Parameters { get; } = new();
66
}

‎6.0/BlazorSample_WebAssembly/Pages/dynamiccomponent/DynamicComponentExample1.razor‎

Lines changed: 19 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
Select your transport:
88
<select @onchange="OnDropdownChange">
99
<option value="">Select a value</option>
10-
<option value="@nameof(RocketLab)">Rocket Lab</option>
11-
<option value="@nameof(SpaceX)">SpaceX</option>
12-
<option value="@nameof(UnitedLaunchAlliance)">ULA</option>
13-
<option value="@nameof(VirginGalactic)">Virgin Galactic</option>
10+
@foreach (var entry in components.Keys)
11+
{
12+
<option value="@entry">@entry</option>
13+
}
1414
</select>
1515
</label>
1616
</p>
@@ -23,16 +23,24 @@
2323
}
2424

2525
@code {
26+
private readonly Dictionary<string, Type> components = new()
27+
{
28+
["Rocket Lab"] = typeof(RocketLab),
29+
["SpaceX"] = typeof(SpaceX),
30+
["ULA"] = typeof(UnitedLaunchAlliance),
31+
["Virgin Galactic"] = typeof(VirginGalactic)
32+
};
2633
private Type? selectedType;
2734

2835
private void OnDropdownChange(ChangeEventArgs e)
2936
{
30-
/*
31-
IMPORTANT!
32-
Change "BlazorSample.Shared.dynamiccomponent" to match
33-
your shared component's namespace in the Type.GetType() argument.
34-
*/
35-
selectedType = e.Value?.ToString()?.Length > 0 ?
36-
Type.GetType($"BlazorSample.Shared.dynamiccomponent.{e.Value}") : null;
37+
if ((e.Value is string dropdownValue) && !String.IsNullOrWhiteSpace(dropdownValue))
38+
{
39+
selectedType = components[dropdownValue];
40+
}
41+
else
42+
{
43+
selectedType = null;
44+
}
3745
}
3846
}

0 commit comments

Comments
 (0)