Vulnerability in EPiServer.Forms

Try our conversational search powered by Generative AI!

Area: Optimizely Search & Navigation
ARCHIVED This content is retired and no longer maintained. See the latest version here.

Recommended reading 

When searching with the general .NET API, search queries are usually executed using the GetResult method. The method returns, among other things, matching objects or projections from matching objects by de-serializing them from JSON. However, when executing a query for EPiServer pages and files stored in VPP folder, you often want the returned objects to be Episerver objects, such as PageData objects, returned from the EPiServer APIs, not objects deserialized from the index.

In fact, de-serializing PageData objects from the index does not work out-of-the-box. Instead, by only retrieving a reference to matching objects and then fetching them from, for instance EPiServer DataFactory, you can be confident that they hold the latest data from the database. You can also update or delete them if desired. The integration contains two extension methods that handle this process: GetContentResult and GetFilesResult.


To use GetContentResult or GetFilesResult, create a search query for IContent objects or UnifiedFile objects. Then, use these methods instead of the regular GetResult method to execute the query and retrieve the results.



If you don't want the whole IContent or UnifiedFile object but rather a subset of their content, perhaps with highlighting, you can instead use the regular GetResult method after creating a projection using the Select method (described in the Searching section of this documentation).

Language handling

The GetContentResult method automatically adds a filter to the search request to select content from the current language branch as determined by the EPiServer LanguageSelector.Autodetect() method. To select pages from a specific language branch, use an overload that accepts a LanguageSelector instance.

  .GetContentResult(new LanguageSelector("sv"));


As opposed to the GetResult method, which does no caching by default, the GetContentResult method automatically adds caching for a minute. However, to make sure that query results are not updated, it adds query results to the cache with a dependency on the EPiServer master cache key. This means that the cache is cleared whenever an EPiServer content is saved or deleted. This is similar to the way that EPiServer output cache works.

Note that the cache key is generated from the query. This means that if you use queries containing dates, you should normalize dates to minutes or hours, as you do not otherwise benefit from caching while filling up the cache with unused data. In other words, avoid filtering using DateTime.Now.

Accessing the actual search results

GetContentResult and GetFilesResult both return instances of a type which contains the matching objects, such as matching content objects. These types are ContentResult and FilesResult. This is accomplished by fetching the matching objects IDs from the search engine then fetching the actual objects from the CMS' API. Sometimes, you may need to use the actual search results (of type SearchResults), for instance in order to track statistics. Both ContentResult and ContentResult expose these through the SearchResult property.

Do you find this information helpful? Please log in to provide feedback.

Last updated: Feb 23, 2015

Recommended reading