ViNull, Off the Record : asp.net

ASP.NET: Cannot use a leading .. to exit above the top directory

Michael C. Neel — Fri, 12 Mar 2010 20:09:00 GMT

This is a really quick post, mostly for myself so the next time I have this issue I can find the answer (yes, I often search my blog before google).

The error “Cannot use a leading .. to exit above the top directory” can be thrown by ASP.NET when you use relative paths incorrectly. If you generate a url with too many “../../../” levels in it that would take the user above the root directory, you can generate the exception.

Why the exception? Security I guess, but it’s a client URL and the server should know better than let the internet walk the C drive, but at one time a company in Redmond had servers with just such issues. My problem isn’t with the unneeded exception (after all, it would just be a 404 link worst case), but with the bug in ASP.NET that causes it.

If you are using Server.Transfer or HttpContext.RewritePath to redirect a request (say map it to a template page) and have a HyperLink control with the ImageUrl property set, you win an extra “../” by the framework. The fix is to wrap the HyperLink control around an Image control.

In code, if you have:

<asp:HyperLink runat="server" NavigateUrl="~/FlyPage.aspx"
    ImageUrl="~/Images/DeadFly.png" Width="200" Height="200"/>

Change it to:

<asp:HyperLink runat="server" NavigateUrl="~/FlyPage.aspx">
    <asp:Image runat="server" ImageUrl="~/Images/DeadFly.png"
    Width="200" Height="200" />
</asp:HyperLink>

(I said it was a quick post… now go register for CodeStock!)

ASP.NET: Creating a UserControl with Child Content

Michael C. Neel — Tue, 08 Dec 2009 02:10:00 GMT

I love ASP.NET User Controls, aka “ascx” files. These little guys are great for reusable content and dividing up the components of a website. The little brother of the more powerful Custom Server Control, they have some limitations, but I’ve found they are often sold short. Once falsehood is that a User Control cannot contain content between the opening and closing tags, like such:

<MyControls:ContentBlock runat="server" Title="The Control has Content!">
    <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. 
    Donec ut nisi sed elit aliquam vulputate eu et lacus</p>
    <asp:HyperLink runat="server" NavigateUrl="~/">Home</asp:HyperLink>
</MyControls:ContentBlock>

If you attempt something like this with a stock User Control you’ll get “Type 'ASP.mycontent_contentblock_ascx' does not have a public property named 'p'.” If we just want to have a simple control that formats the content, then we only need a few tweaks and we can keep the User Control (if you have more advanced needs, then it’s time to step up to a Custom Server Control).

The first tweak is to wrap the ascx template in a single control:

<%@ Control Language="C#" AutoEventWireup="true" 
    CodeFile="ContentBlock.ascx.cs" Inherits="MyControl_ContentBlock" %>
<asp:PlaceHolder ID="phContent" runat="server">
    <h1>
        <%= Title %>
    </h1>
    <div class="body">
        <%= Text %>
    </div>
</asp:PlaceHolder>

I choose a PlaceHolder control because it won’t emit any HTML. Then in code-behind we need to make a few tweaks:

[ParseChildren(false)]
public partial class MyContent_ContentBlock : System.Web.UI.UserControl
{
    public String Title { get; set; }
    protected String Text { get; set; }

    protected override void AddParsedSubObject(object obj) {
        if (obj is LiteralControl) 
            this.Text += ((LiteralControl)obj).Text;

        else if (obj is PlaceHolder && !String.IsNullOrEmpty(((PlaceHolder)obj).ID) 
            && ((PlaceHolder)obj).ID.Equals("phContent")) 
            base.AddParsedSubObject(obj);

        else {
            StringBuilder sb = new StringBuilder();
            using (StringWriter sw = new StringWriter(sb)) {
                using (HtmlTextWriter w = new HtmlTextWriter(sw)) {
                    ((Control)obj).RenderControl(w);
                    this.Text += sb.ToString();
                }
            }
        }
    }
}

The class gets a new attribute, ParseChildren, set to false. I’m stealing this attribute from the Custom Server Control which normally would use this attribute to map the child content to a property. Setting it to false however on a User Control will stop the framework from throwing an error on the User Control. If you stop here, the output of the control would look something like:

<h1>
    The Control has Content!
</h1>
<div class="body">
</div>
<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. 
Donec ut nisi sed elit aliquam vulputate eu et lacus</p>
<a href="/Default.aspx">Home</a>

The content was appended to the User Control template. This can be fixed by overriding the AddParsedSubObject method. This method is called for every control in the User Control – including the PlaceHolder that acts as our template. Any HTML content is converted into a LiteralControl. The logic checks the control being passed in, and if it’s a LiteralControl the text is added to the control’s Text property. If the control is the PlaceHolder it is passed to the base method to let normal processing takeover. The remaining controls are rendered, and the text appended to the control’s Text property. Technically I don’t need the special case for LiteralControls, since the last case will handle it, but it’s the common case and worth saving the additional CPU cycles required to use the RenderControl method.

We now have the proper output:

<h1>
    The Control has Content!
</h1>
<div class="body">
    <p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. 
    Donec ut nisi sed elit aliquam vulputate eu et lacus</p>
    <a href="/Default.aspx">Home</a>
</div>

There is a gotcha with this approach (beyond advanced data binding and postback issues you may encounter) – the following code will botch the output:

<MyControls:ContentBlock runat="server">
    <%= DateTime.Now %>
</MyControls:ContentBlock>

Simply put, Code Blocks change the way controls get processed. Wrapping Code Blocks in another server control will work around this problem:

<MyControls:ContentBlock runat="server">
    <asp:PlaceHolder runat="server"><%= DateTime.Now %></asp:PlaceHolder>
</MyControls:ContentBlock>

Now that you have this new power, promise me you’ll only use it where proper and create a Custom Server Control when needed.

Promise?

ASP.NET SEO Interview on Polymorphic Podcast

Michael C. Neel — Tue, 14 Oct 2008 01:05:37 GMT

Craig Shoemaker just posted the latest episode of the Polymorphic Podcast: ASP.NET SEO - Interview with Michael Neel. Yes, I've now appeared in a podcast that I didn't have a hand in recording!

Even if you don't listen to the show (and you should, Craig does an awesome job) check out the show notes. SEO - or Search Engine Optimization - is one of those areas developers tend to overlook or outright ignore. I think this is partly because it's not something we think about when knee deep in site code, but also because there is a stigma attached to SEO that it is dirty marketing stuff. Truth is, a good design for SEO is also a good design for users and helps more people find what they need (I was glad to see StackOverflow realize the sitemap protocol is very helpful).

One thing I mention at the end of the podcast (at least I think it's the end - I haven't listened to it yet!) was the new support from System.Web.Routing to handle some of the code I have written myself in mapping urls to content. Wally McClure has just recently posted an ASP.NET Podcast on Routing with WebForms that explains the new API.

Using LINQ to generate HTML

Michael C. Neel — Sun, 03 Aug 2008 17:55:20 GMT

I hate seeing code mixed with markup.

Seeing a template page with <% if(show) { %> makes me want to claw my eyes out. Seeing String htmlTitle = "<h1>" + title + "</h1>" causes me to vomit up a little something in my throat.

Mixing code with markup is not a magic chocolate and peanut butter combination - it's a volatile cocktail of vinegar and baking soda waiting to explode your application to tiny Server 500 Error giblets.

The time comes however when we find ourselves needing to generate some well formed HTML in code, and I found myself in just such a position last night adding the agenda to the CodeStock website. (Less than one week away now!)

Background: On the CodeStock site, the speakers and sessions list lives in an XML file. The agenda page has a grid of session times and my task was to fill in each session "cell" with the session planned for that room and time. I wanted to link to the full session and also list the speaker's name in the cell. In the XML I have created Key elements that are used as HTML anchors in a link to a session. It's all very low tech, simplistic goodness. An example of the XML for a speaker:

<Speaker>
    <Key>Brownell</Key>
    <Name>Steve Brownell</Name>
    <Website>http://enthusiasticprogramming.blogspot.com</Website>
    <Photo>~/Speakers/SteveBrownell.png</Photo>
    <Bio>
        Steve is the manager for research and development at AllMeds in Oak Ridge, TN.  Steve
        has been programming one thing or another for over twenty years.  AllMeds makes and
        sells a commercial software product which is an electronic medical record system.  We've
        been .NET based since 2000.  AllMeds is a VB.NET shop at heart, but the AllMeds system spans
        many areas of Windows development.
    </Bio>
    <Session>
        <Key>Hobbled</Key>
        <Title>
            The Hobbled:  There And Back Again, or Code Automation:  how I made it from the
            presentation layer to the database and back.
        </Title>
        <Abstract>
            Stop writing code, and start writing code that writes code.  There's never been more
            choices to help you automate the creation of the data object layers immediately above
            the database.  Writing class factories and data access classes is boring, time consuming
            and wastes valuable time with expensive developer resources.  This course will examine
            two current approaches:  using a template engine and programming with the CODEDOM.  We'll
            also briefly discuss other ORM techniques like LINQ to SQL Classes.
        </Abstract>
        <Level>200</Level>
        <Technology>VB.NET, C#, LINQ, SQL</Technology>
    </Session>
</Speaker>

(Steve was our CodeStock Speaker Idol winner, and I enjoyed seeing System.Codedom in action; something I'll be playing with and posting on in the future thanks to Steve!)

LINQ to XML, and the new "X" classes that come with it make working with XML as easy as it should have always been. Armed with LINQ, I decided that putting <%= SessionInfo("Hobbled") %> was something I could live with (had this been a larger site that needed to live longer than August 9th, I would have opted for a user control <CodeStock:SessionInfo Key="Hobbled"/>). My first LINQ expression looked something like the following:

var info = (from s in speakers.Descendants("Session")
            where s.Element("Key").Value.Equals(SessionKey)
            select new {
                key = s.Element("Key").Value,
                title = s.Element("Title").Value.Trim(),
                speaker = s.Parent.Element("Name").Value
            }).First();

This yields a very useful info object with just the information I need. *If* I was in a hurry, and didn't mind a little vomit, I would follow on with the following:

String hmtl = String.Format("<a href='{0:s}' title='{1:s}'>{2:s}</a><br />{3:s}",
    new object[] { ExpandURL("~/Pages/Agenda.aspx", info.key),
                   info.title,
                   info.title.Length > 30 ? info.title.Substring(0, 27) + "..." : info.title,
                   info.speaker });

Why do I despise this so much? It's not easy to read, and it can become cumbersome to change. ASP.NET has a collection of server controls just for generating HTML, intended for use in user controls but they are not limited to user controls alone. To generate the html above would look something like this:

HtmlAnchor aHref = new HtmlAnchor() {
    HRef = ExpandURL("~/Pages/Agenda.aspx", info.key),
    InnerText = info.title.Length > 30 ? info.title.Substring(0, 27) + "..." : info.title,
    Title = Title
};
HtmlGenericControl div = new HtmlGenericControl("div") {
    InnerText = info.speaker
};

StringBuilder html = new StringBuilder();
using (StringWriter sw = new StringWriter(html)) {
    using (HtmlTextWriter hw = new HtmlTextWriter(sw)) {
        aHref.RenderControl(hw);
        div.RenderControl(hw);
        hw.Close();
    }
    sw.Close();
}

There are times when working with parts of the .Net framework I have wonder if some Java types didn't design the class. The mess here to render the HTML is one of those times. The lack of a RenderControl that returns a String is the problem - thankfully we now have extension methods to fix the framework, but that's another post. No matter how much I hate markup in the code, I cannot endorse this version over the vomit inducing first solution.

It occurs to me that HTML is (or was once) fundamentally XML, and I can return XML from my LINQ expression. In fact, this is what LINQ is about - not just getting the data you want, but getting it in the format you need. Here is the new LINQ query:

XElement info = (from s in speakers.Descendants("Session")
                 where s.Element("Key").Value.Equals(SessionKey)
                 let key = s.Element("Key").Value
                 let title = s.Element("Title").Value.Trim()
                 let shortTitle = title.Length > 30 ? 
                    title.Substring(0, 27) + "..." : title
                 let session = new XElement("a",
                              new XAttribute("href",
                                  ExpandURL("~/Pages/Agenda.aspx", key)),
                              new XAttribute("title", title),
                              shortTitle)
                 let speaker = new XElement("div", s.Parent.Element("Name").Value)
                 select new XElement("span", session, speaker)).First();

This may not seem to some as better. I myself have trouble looking at most LINQ expressions, but as I'm learning to Thinq Linq I'm seeing that writing the LINQ expression is where the power lies, not in the syntax. The mental dialog goes something like this:

"Okay, from my list of speakers I want a session where the session's key matches SessionKey. Now, let me grab some fields I need, first the key, then the title which I need to trim off excess whitespace, then let's make a short version of that title since Steve's title is so long - love that title though. I'll need an link tag for the session; set the href and title attributes, and then add the speaker's name in a div tag so I get a cheap line break. I'm really in XML not HTML, so I'll need a root node and a span tag will work without affecting layout, and I'll add the link and div tags as children."

Writing LINQ like this I feel much closer to the problem I'm trying to solve, and not bogged down by syntax. There is still some moments I'm thrust back to code, such as the use of First() to select only one result. I'd like to have a "select first" option in LINQ expressions instead of just the extension methods.

Is this something I'll be using now every time I have this problem? Not sure yet, but it's another "tool in the box" I'll keep around and use when it feels right.

Session, ForEach, and a ShallowCopy walk into a bar...

Michael C. Neel — Mon, 14 Apr 2008 18:12:00 GMT

Before we get started, let's play "questions you only hear during an interview." Are the contestants ready? Good, here is the question: What is the difference between a shallow copy and a deep copy?

MSDN on Object.MemberwiseClone: "Consider an object called X that references objects A and B. Object B, in turn, references object C. A shallow copy of X creates new object X2 that also references objects A and B. In contrast, a deep copy of X creates a new object X2 that references the new objects A2 and B2, which are copies of A and B. B2, in turn, references the new object C2, which is a copy C."

Clear as mud? Okay, think of it this was - if you made a shallow copy of a directory it would copy only the files in the top level of the directory and create shortcut links to the subfolders. A deep copy would copy the files, all subfolders and their file, and the subfolder's subfolders and files, etc. In C#/.Net world, 99% of the time you are making shallow copies.

It common for me to have an asp.net app that gets data from a webservice, and then applies filters selected by the user. Since the user will change sorting, filters, etc with the same set of data several times, I cache the call to the webservice in Session. (Note: It's okay because I expect only 2-4 user's at a time on these, mostly internal applications - don't do this if you need to scale beyond a small set of users!). It looks something like:

    public ShowProduct[] Products { 
        get {
            return Session["Products"] == null ? 
                new ShowProduct[0] : 
                (ShowProduct[])Session["Products"];
        }
        set {
            Session["Products"] = value;
        }
    }

    protected void LoadProducts()
    {
        ShowServiceSoap svc = new ShowServiceSoap();
        Products = svc.GetProductsByShowID(
            String.Empty, 
            Convert.ToDecimal(ddlShows.SelectedValue));
    }

    protected void FilterProducts() {
        ShowProduct[] products = Products;

        if (cbFilterSizeable.Checked) {
            products = (from p in products 
                        where p.Sizeable.Equals(true) 
                        select p).ToArray();
        }

        gvProducts.DataSource = products;
        gvProducts.DataBind();
    }

This works just fine. In practice, there are many steps in the FilterProducts method and I add some dependency injection options beyond using a property to access session, but you get the idea. These methods are called from event handlers on the web form.

Now, I had a request to add an option to filter product videos to only .AVI, which are stored in the ShowProduct.Video list, so I changed FilterProducts like so:

    protected void FilterProducts() {
        ShowProduct[] products = Products;

        if (cbFilterSizeable.Checked) {
            products = (from p in products 
                        where p.Sizeable.Equals(true) 
                        select p).ToArray();
        }

        if (cbFilterAviOnly.Checked) {
            foreach (ShowProduct p in products)
                p.Videos = (from v in p.Videos
                            where v.FileType.Equals("AVI", 
                                StringComparison.CurrentCultureIgnoreCase)
                            select v).ToArray();
        }

        gvProducts.DataSource = products;
        gvProducts.DataBind();
    }

If you see the error, and understand why it happens, congratulations! If you are like me you noticed that when this runs, and the user filters AVI only, all works as expected. When they remove the filter however, the non-AVI files do not return. More confusing is that if they filtered Sizeable products only, and the removed the filter, the missing product did return! What's going on?

        ShowProduct[] products = Products;

This made a shallow copy of the array in Session. Each ShowProduct was copied, but the Videos array was a reference. When I changed the Videos array in the shallow copy, it changed the object in Session because both Session and my copy pointed at the same location in memory.

I searched around for a bit to find a way to solve my problem; i.e. how to make a deep copy in C#/.Net. There is a method System.FantasyFramework.DeepCopy that will take any object type and return a deep copy of that object back, but I can't get my Visual Studio to find the dll for System.FantasyFramework in the GAC. Many people have this issue as well, and resort to implementing ICloneable on their object so that the object deep copies itself instead of shallow copies or write an extension method to deep copy the Array class. I however opted for the quick fix below:

    public ShowProduct[] Products { 
        get {
            if (Session["ShowProducts"] == null)
                return null;

            Object result = null;
            using (MemoryStream ms = new MemoryStream()) {
                BinaryFormatter bf = new BinaryFormatter();
                bf.Serialize(ms, Session["ShowProducts"]);
                ms.Seek(0, SeekOrigin.Begin);
                result = bf.Deserialize(ms);
                ms.Close();
            }
            
            return (ShowProduct[])result;

        }
        set {
            Session["Products"] = value;
        }
    }

When accessed, the property loads the shallow copy from Session, then Serializes it to memory, then load it's back and returns the result. This "washes" away any references and makes a full deep copy of the array. (You do remember the part about not needing this to scale right? Cool, do don't this on your public website's homepage). This is also a case where good TDD practices have benefits beyond making it easier to write unit tests.

As for the end of the bar joke, I'm afraid I don't have a punch-line yet. I think it will have something to do with Session drinking only water, while ForEach and ShallowCopy see who can do the most shots of tequila - until Session falls over drunk.