Automatically HtmlEncode strings when the model is serialized with Json.Net - c#

Is there a way to configure Json.Net to automatically encode all strings like HtmlEncode(myString) when the model is serialized?

You could use a solution similar to the one in Selectively escape HTML in strings during deserialization, with a couple of minor changes:
Change the HtmlEncodingValueProvider to apply the encoding in GetValue rather than SetValue (so that it does the encoding on serialization rather than deserialization).
Change the resolver to apply the value provider to all string properties rather than looking for an attribute.
Here is what the resulting code would look like:
public class CustomResolver : DefaultContractResolver
{
protected override IList<JsonProperty> CreateProperties(Type type, MemberSerialization memberSerialization)
{
IList<JsonProperty> props = base.CreateProperties(type, memberSerialization);
// Attach an HtmlEncodingValueProvider instance to all string properties
foreach (JsonProperty prop in props.Where(p => p.PropertyType == typeof(string)))
{
PropertyInfo pi = type.GetProperty(prop.UnderlyingName);
if (pi != null)
{
prop.ValueProvider = new HtmlEncodingValueProvider(pi);
}
}
return props;
}
protected class HtmlEncodingValueProvider : IValueProvider
{
PropertyInfo targetProperty;
public HtmlEncodingValueProvider(PropertyInfo targetProperty)
{
this.targetProperty = targetProperty;
}
// SetValue gets called by Json.Net during deserialization.
// The value parameter has the original value read from the JSON;
// target is the object on which to set the value.
public void SetValue(object target, object value)
{
targetProperty.SetValue(target, (string)value);
}
// GetValue is called by Json.Net during serialization.
// The target parameter has the object from which to read the string;
// the return value is the string that gets written to the JSON
public object GetValue(object target)
{
string value = (string)targetProperty.GetValue(target);
return System.Web.HttpUtility.HtmlEncode(value);
}
}
}
Use the custom ContractResolver like this:
var settings = new JsonSerializerSettings
{
ContractResolver = new CustomResolver(),
Formatting = Formatting.Indented
};
string json = JsonConvert.SerializeObject(your_object, settings);
Fiddle: https://dotnetfiddle.net/RhFlk8

Try this:
var json = JObject.Parse("{'Name':'<script>alert(1);</script>'}");
var serializerSettings = new JsonSerializerSettings()
{
StringEscapeHandling = StringEscapeHandling.EscapeHtml
};
var result = JsonConvert.SerializeObject(json, serializerSettings);
result will be:
{"Name":"\u003cscript\u003ealert(1);\u003c/script\u003e"}

I found a very simple way doing this (WebAPI2).
When you set your object properties, just encode it with below.
myObject.encoded_field = HttpUtility.HtmlEncode(your_html_content)

Related

Removing User Object Property

I am trying to remove a property within a Microsoft.graph User object.
I am currently using the "Property.Remove()" method. First, I am setting the User object to a deserialized JObject.
The way I am doing this is serializing the User object into a Json string (jsonString) and deserializing jsonString (jsonStringUpdated). Afterwards, I am calling jsonStringUpdated.property("____") .Remove();
Is there a simpler way to do this? Below is an example:
{
string jsonString = JsonConvert.SerializeObject(user);
var jsonStringUpdated = (JObject)JsonConvert.DeserializeObject(jsonString);
jsonStringUpdated.Property("country").Remove();
}
I would not say that this is simpler option, but I would say that it is better one (in terms of reusability, flexibility and possibly performance). You can create custom contract resolver:
// generic type parameter can be omitted with hardcoding typeof
// handling for multiple properties can be added
public class IgnorePropertyResolver<T> : DefaultContractResolver
{
private readonly string _propName;
public IgnorePropertyResolver(string propName)
{
_propName = propName;
}
protected override JsonProperty CreateProperty(MemberInfo member, MemberSerialization memberSerialization)
{
var property = base.CreateProperty(member, memberSerialization);
if (typeof(T).IsAssignableFrom(member.DeclaringType) && member.Name == _propName)
{
property.ShouldSerialize = o => false;
}
return property;
}
}
And usage:
class MyClass
{
public int Prop1 { get; set; }
public int Prop2 { get; set; }
}
var serializeObject = JsonConvert.SerializeObject(new MyClass(),
new JsonSerializerSettings
{
ContractResolver = new IgnorePropertyResolver<MyClass>(nameof(MyClass.Prop2))
});
Console.WriteLine(serializeObject); // prints {"Prop1":0}

Custom resolver is ignored when trying to serialize an Exception

I'd like to serialize an Exception using a custom resolver.
Here's an example custom resolver - which should serialize only specified properties:
public class IncludeSpecifiedPropsResolver : DefaultContractResolver
{
string[] propsToSerialize = null;
public IncludeSpecifiedPropsResolver(params string[] propsToSerialize)
{
this.propsToSerialize = propsToSerialize;
}
protected override IList<JsonProperty> CreateProperties(Type type, MemberSerialization memberSerialization)
{
var allProps = base.CreateProperties(type, memberSerialization);
if (propsToSerialize == null || propsToSerialize.Length == 0)
{
return allProps;
}
return allProps.Where(p => propsToSerialize.Contains(p.PropertyName)).ToList();
}
}
Example usage:
string test = JsonConvert.SerializeObject(new Exception("Something went wrong"), new JsonSerializerSettings()
{
ContractResolver = new IncludeSpecifiedPropsResolver("Message")
});
However, CreateProperties is ignored.
What else is missing so that the custom resolver would work as expected?
The problem here is that Exception implements the ISerializable interface, which has special handling in the DefaultContractResolver: the code path does not go through CreateProperties(). You can override this behavior by setting the IgnoreSerializableInterface property to true in the constructor of your resolver. If you do this, your code will work as intended.
public IncludeSpecifiedPropsResolver(params string[] propsToSerialize)
{
this.propsToSerialize = propsToSerialize;
IgnoreSerializableInterface = true;
}
Working demo: https://dotnetfiddle.net/DNhwaH

Prevent serialization if value is null or whitespace in JSON.NET

I have an object that needs to be serialized in such a way that both null and "whitespace" (empty or just spaces) values are not serialized. I don't control the object itself and therefore can't set attributes, but I know that all the properties are strings. Setting NullValueHandling to Ignore obviously only gets me part of the way to the solution.
It "seems" (as best I understand) like what I need to do is create a custom DefaultContractResolver but I haven't come up with a solution that works. Here are a couple failed attempts, for reference, that throw no exceptions but have no obvious effect on the serialization either:
public class NoNullWhiteSpaceResolver : DefaultContractResolver
{
public static readonly NoNullWhiteSpaceResolver Instance = new NoNullWhiteSpaceResolver();
protected override JsonProperty CreateProperty(MemberInfo member, MemberSerialization memberSerialization)
{
var property = base.CreateProperty(member, memberSerialization);
/* this doesn't work either
if (property.ValueProvider.GetValue(member) == null ||
(property.PropertyType == typeof(string) &&
string.IsNullOrWhiteSpace((string)property.ValueProvider.GetValue(member))))
{
property.ShouldSerialize = i => false;
}*/
if (property.PropertyType == typeof(string))
{
property.ShouldSerialize =
instance =>
{
try
{
string s = (string) instance;
bool shouldSkip = string.IsNullOrWhiteSpace(s);
return !string.IsNullOrWhiteSpace(s);
}
catch
{
return true;
}
};
}
return property;
}
}
I'm implementing the resolver by
string str = JsonConvert.SerializeObject(obj, new JsonSerializerSettings
{
Formatting = Formatting.None;
ContractResolver = new NoNullWhiteSpaceResolver();
});
Maybe I'm going about this backward but I appreciate any insights people have. I've worked around the issue by using an extension method/reflection to iterate over the properties of the object and setting the value to null if it's "nullorwhitespace" and then using the standard NullValueHandling but I'm hoping I can find a way to configure all of this in the serialization.
This seems to work:
public class NoNullWhiteSpaceResolver : DefaultContractResolver {
public static readonly NoNullWhiteSpaceResolver Instance = new NoNullWhiteSpaceResolver();
protected override JsonProperty CreateProperty(MemberInfo member, MemberSerialization memberSerialization) {
JsonProperty property = base.CreateProperty(member, memberSerialization);
if (property.PropertyType == typeof(string)) {
property.ShouldSerialize =
instance => {
try {
var rawValue = property.ValueProvider.GetValue(instance);
if (rawValue == null) {
return false;
}
string stringValue = property.ValueProvider.GetValue(instance).ToString();
return !string.IsNullOrWhiteSpace(stringValue);
}
catch {
return true;
}
};
}
return property;
}
}
Using this test class:
public class TestClass {
public string WhiteSpace => " ";
public string Null = null;
public string Empty = string.Empty;
public string Value = "value";
}
This is the output:
{"Value":"value"}

How to default a null JSON property to an empty array during serialization with a List<T> property in JSON.NET?

Currently I have JSON that either comes in via an HTTP call or is stored in a database but during server processing they are mapped to C# objects.
These objects have properties like public List<int> MyArray.
When the JSON contains MyArray:null I want the resulting property to be an empty List<T> instead of a null List<T> property.
The goal is that the object will "reserialize" to JSON as MyArray:[], thus either saving to the database or responding out via HTTP as an empty array instead of null.
That way, no matter what, the C# class is basically scrubbing and enforcing an empty array for any List<T> property that would otherwise be null and cause things to break in the browser side code (for example: cannot read property 'length' of null).
Is there a way that during the serialization/deserialization I can have any null value that is paired to a List<T> property become an empty array instead?
You could always lazy load an empty list if its null.
OR
Use the NullValueHandling option on the JsonDeserializer.
var settings = new JsonSerializerSettings();
settings.NullValueHandling = NullValueHandling.Ignore;
return JsonConvert.DeserializeObject<T>(json, settings);
http://james.newtonking.com/json/help/index.html?topic=html/SerializationSettings.htm
I was going to suggest using a custom JsonConverter to solve this, but a converter will not get called for null values. Instead, you will need to use a custom IContractResolver in combination with a custom IValueProvider. Here is the code you would need (inspired by this answer):
class NullToEmptyListResolver : DefaultContractResolver
{
protected override IValueProvider CreateMemberValueProvider(MemberInfo member)
{
IValueProvider provider = base.CreateMemberValueProvider(member);
if (member.MemberType == MemberTypes.Property)
{
Type propType = ((PropertyInfo)member).PropertyType;
if (propType.IsGenericType &&
propType.GetGenericTypeDefinition() == typeof(List<>))
{
return new EmptyListValueProvider(provider, propType);
}
}
return provider;
}
class EmptyListValueProvider : IValueProvider
{
private IValueProvider innerProvider;
private object defaultValue;
public EmptyListValueProvider(IValueProvider innerProvider, Type listType)
{
this.innerProvider = innerProvider;
defaultValue = Activator.CreateInstance(listType);
}
public void SetValue(object target, object value)
{
innerProvider.SetValue(target, value ?? defaultValue);
}
public object GetValue(object target)
{
return innerProvider.GetValue(target) ?? defaultValue;
}
}
}
Here is a demo which shows how to use the resolver:
class Program
{
static void Main(string[] args)
{
JsonSerializerSettings settings = new JsonSerializerSettings();
settings.ContractResolver = new NullToEmptyListResolver();
settings.ObjectCreationHandling = ObjectCreationHandling.Replace;
settings.Formatting = Formatting.Indented;
Console.WriteLine("Serializing object with null lists...");
Foo foo = new Foo();
string json = JsonConvert.SerializeObject(foo, settings);
Console.WriteLine(json);
Console.WriteLine();
Console.WriteLine("Deserializing JSON with null lists...");
json = #"{ ""IntList"" : null, ""StringList"" : null }";
foo = JsonConvert.DeserializeObject<Foo>(json, settings);
Console.WriteLine("IntList size: " + foo.IntList.Count);
Console.WriteLine("StringList size: " + foo.StringList.Count);
}
}
class Foo
{
public List<int> IntList { get; set; }
public List<string> StringList { get; set; }
}
Output:
Serializing object with null lists...
{
"IntList": [],
"StringList": []
}
Deserializing JSON with null lists...
IntList size: 0
StringList size: 0
The following property will have empty collection assigned to it after deserialization instead of null in both cases: when the property is omitted in JSON or when set to null explicitly:
class A
{
[JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
public IEnumerable<int> Prop { get; set; } = new List<int>();
}
To use Brian Rogers solution in a .net core solution you need a slight modification to access the "IsGenericType" property as it moved from Type to TypeInfo.
The answer marked as correct (setting NullValueHandling) was not working for me, it just ignores the property if it is null.
Full code for .net core:
using System;
using System.Collections.Generic;
using Newtonsoft.Json.Serialization;
using System.Reflection;
public class NullToEmptyListResolver : DefaultContractResolver
{
protected override IValueProvider CreateMemberValueProvider(MemberInfo member)
{
IValueProvider provider = base.CreateMemberValueProvider(member);
if (member.MemberType == MemberTypes.Property)
{
Type propType = ((PropertyInfo)member).PropertyType;
TypeInfo propTypeInfo = propType.GetTypeInfo();
if (propTypeInfo.IsGenericType &&
propType.GetGenericTypeDefinition() == typeof(List<>))
{
return new EmptyListValueProvider(provider, propType);
}
}
return provider;
}
class EmptyListValueProvider : IValueProvider
{
private IValueProvider innerProvider;
private object defaultValue;
public EmptyListValueProvider(IValueProvider innerProvider, Type listType)
{
this.innerProvider = innerProvider;
defaultValue = Activator.CreateInstance(listType);
}
public void SetValue(object target, object value)
{
innerProvider.SetValue(target, value ?? defaultValue);
}
public object GetValue(object target)
{
return innerProvider.GetValue(target) ?? defaultValue;
}
}
}

Order of serialized fields using JSON.NET

Is there a way to specify the order of fields in a serialized JSON object using JSON.NET?
It would be sufficient to specify that a single field always appear first.
The supported way is to use the JsonProperty attribute on the class properties that you want to set the order for. Read the JsonPropertyAttribute order documentation for more information.
Pass the JsonProperty an Order value and the serializer will take care of the rest.
[JsonProperty(Order = 1)]
This is very similar to the
DataMember(Order = 1)
of the System.Runtime.Serialization days.
Here is an important note from #kevin-babcock
... setting the order to 1 will only work if you set an order greater than 1 on all other properties. By default any property without an Order setting will be given an order of -1. So you must either give all serialized properties and order, or set your first item to -2
You can actually control the order by implementing IContractResolver or overriding the DefaultContractResolver's CreateProperties method.
Here's an example of my simple implementation of IContractResolver which orders the properties alphabetically:
public class OrderedContractResolver : DefaultContractResolver
{
protected override System.Collections.Generic.IList<JsonProperty> CreateProperties(System.Type type, MemberSerialization memberSerialization)
{
return base.CreateProperties(type, memberSerialization).OrderBy(p => p.PropertyName).ToList();
}
}
And then set the settings and serialize the object, and the JSON fields will be in alphabetical order:
var settings = new JsonSerializerSettings()
{
ContractResolver = new OrderedContractResolver()
};
var json = JsonConvert.SerializeObject(obj, Formatting.Indented, settings);
In my case Mattias' answer didn't work. The CreateProperties method was never called.
After some debugging of Newtonsoft.Json internals, I came up with another solution.
public class JsonUtility
{
public static string NormalizeJsonString(string json)
{
// Parse json string into JObject.
var parsedObject = JObject.Parse(json);
// Sort properties of JObject.
var normalizedObject = SortPropertiesAlphabetically(parsedObject);
// Serialize JObject .
return JsonConvert.SerializeObject(normalizedObject);
}
private static JObject SortPropertiesAlphabetically(JObject original)
{
var result = new JObject();
foreach (var property in original.Properties().ToList().OrderBy(p => p.Name))
{
var value = property.Value as JObject;
if (value != null)
{
value = SortPropertiesAlphabetically(value);
result.Add(property.Name, value);
}
else
{
result.Add(property.Name, property.Value);
}
}
return result;
}
}
In my case niaher's solution did not work because it didn't handle objects in arrays.
Based on his solution this is what I came up with
public static class JsonUtility
{
public static string NormalizeJsonString(string json)
{
JToken parsed = JToken.Parse(json);
JToken normalized = NormalizeToken(parsed);
return JsonConvert.SerializeObject(normalized);
}
private static JToken NormalizeToken(JToken token)
{
JObject o;
JArray array;
if ((o = token as JObject) != null)
{
List<JProperty> orderedProperties = new List<JProperty>(o.Properties());
orderedProperties.Sort(delegate(JProperty x, JProperty y) { return x.Name.CompareTo(y.Name); });
JObject normalized = new JObject();
foreach (JProperty property in orderedProperties)
{
normalized.Add(property.Name, NormalizeToken(property.Value));
}
return normalized;
}
else if ((array = token as JArray) != null)
{
for (int i = 0; i < array.Count; i++)
{
array[i] = NormalizeToken(array[i]);
}
return array;
}
else
{
return token;
}
}
}
This will work for normal classes, dictionaries and ExpandoObject (dynamic object) as well.
class OrderedPropertiesContractResolver : DefaultContractResolver
{
protected override IList<JsonProperty> CreateProperties(System.Type type, MemberSerialization memberSerialization)
{
var props = base.CreateProperties(type, memberSerialization);
return props.OrderBy(p => p.PropertyName).ToList();
}
}
class OrderedExpandoPropertiesConverter : ExpandoObjectConverter
{
public override bool CanWrite
{
get { return true; }
}
public override void WriteJson(JsonWriter writer, object value, JsonSerializer serializer)
{
var expando = (IDictionary<string, object>)value;
var orderedDictionary = expando.OrderBy(x => x.Key).ToDictionary(t => t.Key, t => t.Value);
serializer.Serialize(writer, orderedDictionary);
}
}
var settings = new JsonSerializerSettings
{
ContractResolver = new OrderedPropertiesContractResolver(),
Converters = { new OrderedExpandoPropertiesConverter() }
};
var serializedString = JsonConvert.SerializeObject(obj, settings);
If you just want to pull a single attribute up to the front without thinking about the perhaps unintuitive number system, just use int.MinValue.
[JsonProperty(Order = int.MinValue)]
As Charlie noted, you can somewhat control the ordering of the JSON properties by ordering the properties in the class itself. Unfortunately, this approach doesn't work for properties inherited from a base class. The base class properties will be ordered as they are laid out in code, but will appear before the base class properties.
And for anyone wondering why you might want to alphabetize JSON properties, it's a whole lot easier to work with raw JSON files, particularly for classes with lots of properties, if they are ordered.
If you don't want to put a JsonProperty Order attribute on every class property, then its very simple to make your own ContractResolver...
The IContractResolver interface provides a way to customize how the JsonSerializer serializes and deserializes .NET objects to JSON without placing attributes on your classes.
Like this:
private class SortedPropertiesContractResolver : DefaultContractResolver
{
// use a static instance for optimal performance
static SortedPropertiesContractResolver instance;
static SortedPropertiesContractResolver() { instance = new SortedPropertiesContractResolver(); }
public static SortedPropertiesContractResolver Instance { get { return instance; } }
protected override IList<JsonProperty> CreateProperties(Type type, MemberSerialization memberSerialization)
{
var properties = base.CreateProperties(type, memberSerialization);
if (properties != null)
return properties.OrderBy(p => p.UnderlyingName).ToList();
return properties;
}
}
Implement:
var settings = new JsonSerializerSettings { ContractResolver = SortedPropertiesContractResolver.Instance };
var json = JsonConvert.SerializeObject(obj, Formatting.Indented, settings);
Actually, since my Object was already a JObject, I used the following solution:
public class SortedJObject : JObject
{
public SortedJObject(JObject other)
{
var pairs = new List<KeyValuePair<string, JToken>>();
foreach (var pair in other)
{
pairs.Add(pair);
}
pairs.OrderBy(p => p.Key).ForEach(pair => this[pair.Key] = pair.Value);
}
}
and then use it like this:
string serializedObj = JsonConvert.SerializeObject(new SortedJObject(dataObject));
The following recursive method uses reflection to sort the internal token list on an existing JObject instance rather than creating a brand new sorted object graph. This code relies on internal Json.NET implementation details and should not be used in production.
void SortProperties(JToken token)
{
var obj = token as JObject;
if (obj != null)
{
var props = typeof (JObject)
.GetField("_properties",
BindingFlags.NonPublic | BindingFlags.Instance)
.GetValue(obj);
var items = typeof (Collection<JToken>)
.GetField("items", BindingFlags.NonPublic | BindingFlags.Instance)
.GetValue(props);
ArrayList.Adapter((IList) items)
.Sort(new ComparisonComparer(
(x, y) =>
{
var xProp = x as JProperty;
var yProp = y as JProperty;
return xProp != null && yProp != null
? string.Compare(xProp.Name, yProp.Name)
: 0;
}));
}
foreach (var child in token.Children())
{
SortProperties(child);
}
}
If you control (i.e. write) the class, put the properties in alphabetical order and they will serialize in alphabetical order when JsonConvert.SerializeObject() is called.
I want to serialize an comblex object and keep the order of the properties as they where defined in code. I can't just add [JsonProperty(Order = 1)] because the class itself is out of my scope.
This solution also takes into account that properties which are defined in a base class should have a higher priority.
This may not be bulletproof, since nowhere is defined that the MetaDataAttribute ensures the correct order, but it seems to work. For my use case this is ok. since I only want to maintain human readability for an auto generated config file.
public class PersonWithAge : Person
{
public int Age { get; set; }
}
public class Person
{
public string Name { get; set; }
}
public string GetJson()
{
var thequeen = new PersonWithAge { Name = "Elisabeth", Age = Int32.MaxValue };
var settings = new JsonSerializerSettings()
{
ContractResolver = new MetadataTokenContractResolver(),
};
return JsonConvert.SerializeObject(
thequeen, Newtonsoft.Json.Formatting.Indented, settings
);
}
public class MetadataTokenContractResolver : DefaultContractResolver
{
protected override IList<JsonProperty> CreateProperties(
Type type, MemberSerialization memberSerialization)
{
var props = type
.GetProperties(BindingFlags.Instance
| BindingFlags.Public
| BindingFlags.NonPublic
).ToDictionary(k => k.Name, v =>
{
// first value: declaring type
var classIndex = 0;
var t = type;
while (t != v.DeclaringType)
{
classIndex++;
t = type.BaseType;
}
return Tuple.Create(classIndex, v.MetadataToken);
});
return base.CreateProperties(type, memberSerialization)
.OrderByDescending(p => props[p.PropertyName].Item1)
.ThenBy(p => props[p.PropertyName].Item1)
.ToList();
}
}
If you want to globally configure your API with ordered fields, please combine Mattias Nordberg answer:
public class OrderedContractResolver : DefaultContractResolver
{
protected override System.Collections.Generic.IList<JsonProperty> CreateProperties(System.Type type, MemberSerialization memberSerialization)
{
return base.CreateProperties(type, memberSerialization).OrderBy(p => p.PropertyName).ToList();
}
}
with my answer here:
How to force ASP.NET Web API to always return JSON?
UPDATE
I just saw the downvotes. Please see the answer from 'Steve' below for how to do this.
ORIGINAL
I followed the JsonConvert.SerializeObject(key) method call via reflection (where key was an IList) and found that JsonSerializerInternalWriter.SerializeList gets called. It takes a list and loops through via
for (int i = 0; i < values.Count; i++) { ...
where values is the IList parameter brought in.
Short answer is...No, there's no built in way to set the order the fields are listed in the JSON string.
There's no order of fields in the JSON format so defining an order doesn't make sense.
{ id: 1, name: 'John' } is equivalent to { name: 'John', id: 1 } (both represent a strictly equivalent object instance)

Categories