Develop Reference

Is it safe to render Html that was uploaded as Markdown and converted serverside to Html?

I have a webform that allows users to upload text as Markdown.
The Markdown is converted to Html on the server(using Markdig) and also stored.
When displaying the converted Html that the user uploaded, should I #Html.Encode the content - the project is in c#, MVC 5/razor with request validation on.

Generally it depends on the markdown converter.
By default Markdig doesn't escape html. You can however use the DisableHtml function in the pipeline that escapes all remaining HTML encodable strings that were not processed by previous extensions. This should also give better performance than letting an anti-xss function run over the string again.
See example:
var pipeline = new MarkdownPipelineBuilder().DisableHtml().Build();
var result = Markdig.Markdown.ToHtml("<a href='javascript:evil()'>hello</a>", pipeline);

No, it isn't.
I just trivially tested the following:
hello
and markdig lets it through:
See online example.
Although I haven't looked into it too deeply, the Microsoft AntiXSS library might be useful here:
var safeHtml = Microsoft.Security.Application.Sanitizer
.GetSafeHtmlFragment("<a href='javascript:evil()'>hello</a>");
gives:
hello
but
var safeHtml = Microsoft.Security.Application.Sanitizer
.GetSafeHtmlFragment("<a href='http://stackoverflow.com'>hello</a>");
gives:
hello

Create Campaign - MailChimp API 1.3 - C# Example

Hey Guys I'm trying to create a new campaign via the Mail Chimp API (V1.3)
The method I am using is
campaignCreate(string apikey, string type, array options, array content, array segment_opts, array type_opts)
Documentation found here: https://apidocs.mailchimp.com/api/1.3/campaigncreate.func.php
However I'm struggling to find C# Examples of how to use this method.
Essentially I want to tell the API to send a template (already stored in the MC account) to all the users on a given list.
So Far I have this..
var options = new Campaign.Options(listId, "subjecthere", "user#someDomain.com", "From Name Here", "To Name here");
options.TemplateID = templateId;
var mailChimpSubscribers =
_mcApi.CampaignCreate(Campaign.Type.Regular, options, HELP HERE PLEASE)
The third argument ('content'-Campaign.Content.Base) - is what I'm not sure about, I am already specifying a template so I don't need to pass HTML here, according to the documentation...
If you chose a template instead of pasting in your HTML content, then
use "html_" followed by the template sections as keys - for example,
use a key of "html_MAIN" to fill in the "MAIN" section of a template.
I have one section inside the template I want to fill in...so this sounds like what I need to do...
anyone got any ideas how?

Well, the documentation you posted answers your question pretty directly. Find the name of the section in the template you need to provide content for, add it to html_, and then pass that as the content argument. In JSON, your request would look like this:
{
...
"content": {
"html_MAIN": "Sweet HTML content for my newsletter here."
}
}
I'm not sure which wrapper library you're using, but that's what you want it to do. For most of them that means passing the struct/dict/hash/associative array from content as the right parameter.

Send RTF in a HTML body by email C#

We have an C# application which sends emails to clients. In these emails can be information about several things and this information can contains a note.
Example email:
Person: John
Age: 35
Note: He works as developer.
(Jonn's picture)
(Excel table)
Person: Mary
Age: 40
Note: (Another picture)
bla bla bla
Until now, we extracted the plain text of the note, but now we want to send the whole note (it is written in rtf format and it can contain images, excel tables and so on).
The email body is made in HTML and can contain several notes.
Does someone know what will be the best option to add these notes to the email? Is it that possible? because the body is a HTML document and I have to add several notes... Maybe is it easier as image (try to get an image from the rtf)? or is it better in HTML?
I hope you can help me or guide me.
Thank you in advance.
Regards.

Definitely its possible. I did similar sort of thing. First read RTF contents into a string (say rtfContent) by using InputStreamReader, then pass this string to a method ConvertRtf2Html(rtfContent). You can follow this link to download the project which converts RTF content to HTML and much(I don't know all the functionality, as I used only ConvertRtf2Html() method)

Best Practice to parse email and collect information you need

We have implemented algorithm to parse emails and collect information from it something like if the email is
Hi John,
Here is your reservation info
Name : John F
Date : 2/12/2013
State : NY ....
we save a configuration for each email form like Look for Keys like "Name", "Date", "State".. and those are our KEYS and ":" is a delimiter and anything the follows after ":" is a VALUE for that key. This is how we parse and collect info we wanted. We read the email from GMAIL inbox sometimes the Email body we get from GMAIL is cluttered and our algorithm can't read KEY:VALUE pairs and capture nothing. If you see the Actual email in GMAIL inbox it is neat and tidy with all the formatting and stuff but the Email source we get in the code is different. Not sure if this has to do anything with Encoding. Please suggest what could be the reason. Thanks
Really appreciate your thoughts.
Here is an example the first image is what we see in gmail and 2nd image is what we are getting as a source (plain text NOT HTML.) By the way we are parsing Plain text NOT HTML

How to know if attachment is a signature in an Outlook email

I have an Outlook email and I need to process it's attachments. But when iterating through the attachments, if the attachment is a signature I want to skip it.
To know if the attachment is a signature I am using:
outlookMailItem.Attachments[i].PropertyAccessor.GetProperty(
"http://schemas.microsoft.com/mapi/proptag/0x3712001E");
But I am getting an Outlook security alert.
Is there another way using a safer code? Can it be done using Redemption?

PR_ATTACH_CONTENT_ID property is a good indication that an attachment is an embedded image, but there are attachments that have PR_ATTACH_CONTENT_ID property set, but they are not embedded images (Lotus Notes likes to set PR_ATTACH_CONTENT_ID on all attachments).
Even if PR_ATTACH_CONTENT_ID is not set, Outlook can use PR_ATTACH_CONTENT_LOCATION or PR_ATTACH_LONG_FILENAME to load an embedded image.
The only real test is to parse the HTML body and figure out which <img> tags refer to the attachments.
Redemption (I am its author) will let you access that property using RDOAttachment.Fields, you can also use RDOAttachment.Hidden property, which jumps through a few hoops to figure out whether an attachment is an embedded image and not a "real" attachment.

RDOAttachment.Hidden property works well only if the email format is HTML. For emails in Rich Text Format, the signature image would be treated as any other attachment and will have this value as false. A better bet would be to use "Attachment.Type", which works for both HTML and Rich Text. For signature, it would always be olOLE and for other attachments, it would be olByValue. So, you can filter the signature images using this property. However, note that, if the email format is Rich Text and if you have a screenshot embedded within the email, it's treated as olOLE type.