by MikeGale » Mon Mar 20, 2006 7:17 pm
Hi,
Your suggestions have taken me further than I was.
The <cseignore> helps in some cases. It protects against blocks that can be identified and marked in the XHTML source. (In my test case it reduced error count from 35 to 13.)
It doesn't work with injected script. The ASP.NET (1.1) framework injects script immediately after the form opening element and immediately before the form closing element. I could not find any way to easily force it to inject within a <cseignore></cseignore> block. (That's the residual 13 errors noted above.)
There is also bad markup in the head element and within the opening body tag. I can correct these before a page goes live, though the editing environment (design surface) fouled them up (in 1.1) whenever it touches them. (Fortunately this can be avoided by simply not using the design surface, ever.) I'm not sure whether protection is needed from these.
I was envisaging a solution put together by a user of CSE. For example, I have pages which have the aspx extension but are legal XHTML. Other pages with the same extension have sections that I have decided are outside my control, only those need special handling. It's a case by case thing!
The block protection mechanism in fact makes different CSE configuration unnecessary if it can be implemented completely.
<cseignore> solves a lot the issues, if there were a way to mask injected script it would in fact be exactly what is needed on the test page (and maybe a lot of others.)
I will sent a greatly cut down version of the page by email. It has viewstate and the text of many kilobytes of injected JavaScript deleted.
Summary:
1) <cseignore> is great.
2) If it could catch injected script it would be perfect in some cases. (Maybe a tag like <cseIgnoreScriptBlocksImmediatelyAfter /> / <cseIgnoreScriptBlocksImmediatelyBefore /> tag. Which ignores all contiguous script blocks until something else is found, or <cseIgnoreBlocksImmediatelyAfter tag="script,img" caseinsensitive="true" /> with a before version too.)
3) Foul ups in the head area can be fixed by the developer, I'm not sure whether protection is needed in some circumstances.
NOTE: I used camelCase in the tags, otherwise they're really hard to read, one area where I think the XHTML specification got it wrong!
Another idea: a tag acting like <cseIgnoreBeforeUntil tagUntil="form" /> would do the job and be easier for the developer to insert, he can see the form tags directly in the source.