Vulnerability in EPiServer.Forms
In our index there is about 10K pages of type MyPageType. That type has a property MyPageProperty of type XhtmlString and in some instances there is a certain html tag that I would like to use for filtering.
When I navigate to /episerver/find/#overview/explore and narrow my filtering to page type MyPageType and expand any of the hit results I can confirm that property MyPageProperty has a nicely formatted html with tags.
I have tried to use .Filter delegate method but .Exists() extension method is applicable to int or string but not on XhtmlString type. I also tried to use
.WildCardQuery("*desiredHtmlTag*", x => x.MyPageProperty.To/*any*/String())
If I would to use
I would end up with 1000 instances of pages of type MyPageType. As soon as I would to use
.Filter(x => x.MyPageProperty.ToString().Exists())
just to experiment on things or as a matter of fact any other ToString() method that could be used on XhtmlString type (.ToInternalString() or .ToHtmlString()) I would end up with 0 hits
This happens also if I would try to use
on stringified property in the .Filter delegate method.
Is there any elegant way of filtering through XhtmlString property type on specific html tags?
It's better to put such specific implementations INTO the index instead of trying to write overcomplicated queries, e.g. a custom property in the Find index that will contain your desired HTML tags. It is also not recommended to use "powerful" index methods like WildCardQuery, which has also been removed in Find V14 (see breaking changes).
As a reference, check peteng's answer in this post: https://world.optimizely.com/forum/developer-forum/CMS/Thread-Container/2017/12/index-and-search-for-custom-content-in-episerver-search/
However, if you are in a hurry and have little interest in performance etc., you can probably use the extension AnyWordBeginsWith
// untested code
.Include(x => x.MyPageProperty.AnyWordBeginsWith(theString), 1)
I understand your suggestion on the indexing that property beforehand but in this case I wanted to fetch pages for a scheduled job that should 'migrate' old values to the new ones in case there was a certain html tag present in the XhtmlString property type. Even though the
could not be used with "<tag>" instead of "TheString" because of the wrapping elements that prevented that specific tag to be treated as a word I opted to target the attribute of that specific tag and that did the trick. Thanks for pointing this out to me.