daohualiuxiang
/
AspNetCore.Docs
mirror of https://github.com/dotnet/AspNetCore.Docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Updates to compression warning content (#32167)

pull/32168/head
Luke Latham 2024-03-27 12:33:17 -04:00 committed by GitHub
parent aa55d4891a
commit 1fb5518a7d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
aspnetcore/blazor/includes/compression-with-untrusted-data.md
View File

@ -1,6 +1,6 @@
:::moniker range=">= aspnetcore-9.0"
> [!WARNING>]
> [!WARNING]
> With compression, which is enabled by default, avoid creating secure (authenticated/authorized) interactive server-side components that render data from untrusted sources. Untrusted sources include route parameters, query strings, data from JS interop, and any other source of data that a third-party user can control (databases, external services). For more information, see <xref:blazor/fundamentals/signalr#websocket-compression-for-interactive-server-components> and <xref:blazor/security/server/interactive-server-side-rendering?view=aspnetcore-9.0#interactive-server-components-with-websocket-compression-enabled>.
:::moniker-end

7
aspnetcore/blazor/javascript-interoperability/index.md
View File

@ -32,9 +32,14 @@ Further JS interop guidance is provided in the following articles:
## Compression for interactive server components with untrusted data
<!-- Doc author note: This content is also in an INCLUDE file at
blazor/includes/compression-with-untrusted-data.md because the
text is used in a warning format in two articles. -->
With compression, which is enabled by default, avoid creating secure (authenticated/authorized) interactive server-side components that render data from untrusted sources. Untrusted sources include route parameters, query strings, data from JS interop, and any other source of data that a third-party user can control (databases, external services). For more information, see <xref:blazor/fundamentals/signalr#websocket-compression-for-interactive-server-components> and <xref:blazor/security/server/interactive-server-side-rendering?view=aspnetcore-9.0#interactive-server-components-with-websocket-compression-enabled>.
:::moniker-end
[!INCLUDE[](~/blazor/includes/compression-with-untrusted-data.md)]
## JavaScript interop abstractions and features package