Add html encoding

Encode HTML at exception's description and stack trace to avoid exceptions from telegram bot library
a-gubskiy · Nov 5, 2021 · edf4f2f · edf4f2f
1 parent 0c0a449
commit edf4f2f
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 3 deletions.
diff --git a/src/X.Extensions.Logging.Telegram/TelegramMessageFormatter.cs b/src/X.Extensions.Logging.Telegram/TelegramMessageFormatter.cs
@@ -1,5 +1,7 @@
 using System;
+using System.Net;
 using System.Text;
+
 using Microsoft.Extensions.Logging;
 
 namespace X.Extensions.Logging.Telegram
@@ -45,7 +47,7 @@ public string Format<TState>(
             if (exception != null)
             {
                 sb.AppendLine();
-                sb.AppendLine($"<pre>{exception}</pre>");
+                sb.AppendLine($"<pre>{WebUtility.HtmlEncode(exception.ToString())}</pre>");
                 sb.AppendLine();
             }
 

diff --git a/tests/X.Extensions.Logging.Telegram.Tests/TelegramLoggingTests.cs b/tests/X.Extensions.Logging.Telegram.Tests/TelegramLoggingTests.cs
@@ -1,4 +1,6 @@
-using System;
+using System.Net;
+using System.Text.Encodings.Web;
+
 using Microsoft.Extensions.Logging;
 using NUnit.Framework;
 
@@ -13,7 +15,7 @@ public void Setup()
         }
 
         [Test]
-        public void Test1()
+        public void Test_MessageFormatter_MessageNotNull()
         {
             var options = new TelegramLoggerOptions
             {
@@ -29,5 +31,22 @@ public void Test1()
 
             Assert.NotNull(message);
         }
+
+        [TestCase("<p style=\"font-family='Lucida Console'\">Exception message description</p>")]
+        [TestCase("<p style=\"font-family='Lucida Console';width:100%\">Exception <br/><i><b>message</b></i> description</p>")]
+        public void ExceptionDescriptionWithRawHtmlTest(string description)
+        {
+            var encodedHtml = WebUtility.HtmlEncode(description);
+
+            var containsRawHtml = encodedHtml.Contains("<p style=\"font-family='Lucida Console'\">") ||
+                                        encodedHtml.Contains("</p>") ||
+                                        encodedHtml.Contains("<br/>") ||
+                                        encodedHtml.Contains("<i>") ||
+                                        encodedHtml.Contains("</i>") ||
+                                        encodedHtml.Contains("<b>") ||
+                                        encodedHtml.Contains("</b>");
+
+            Assert.False(containsRawHtml);
+        }
     }
 }