Remove Html.JavaScriptEncoder property

[blowdart]

This @ method is unsafe. It needs to be removed.

We've been recommending the safe approach for a couple of years, which is you put the data inside a DIV tag, in a data attribute, at which point @ and HTML encoding works just fine.

There are cases where simply Javascript encoding introduces XSS (for example, outputting into an OnX attribute on an element). The existence of this method encourages folks to do the wrong thing.

[Eilon]

This is the property in question: https://github.com/aspnet/Mvc/blob/dev/src/Microsoft.AspNetCore.Mvc.ViewFeatures/Rendering/IHtmlHelper.cs#L61-L64

It doesn't appear to be used anywhere in MVC, so it should be fairly clean to remove.

[kichalla]

bf93c7d

[gdoron]

@blowdart Can you please give me a link to an article showing how can it be exploited?
Having to write the text in html and use javascript to read it is very awkward 😢

Will it ever be safe or just forget about its existence?

[blowdart]

I won't, because it's very use specific. Please just forget about its existence.

[gdoron]

Existence of what? 😝
Thanks