Search code examples
c#asp.net-mvc-4isolationrazor-2

How can i isolate Razor Views?


Is there a way to expose Razor syntax and (custom) helpers to people , but say ... not allow them to create code blocks or , to only limit them in the usage of the helpers and to not give them the power to execute pure C# code in the views ?

Any ideas and pointers to similar solutions are welcome !

update:// I would like to give the users the power to write their own HTML and access only to a list of html helpers. Mostly the default ones and the ones i create.

For example i do not want them to be able to execute code within @{ //code } blocks and Also no using and @model ( not sure about this one) only have access to @Html.* @if else for foreach

or better yet , give them access only to specific namespaces (this just a thought tho)

update:// After some testing , i found out that RazorEngine does as close as to what i'm trying to do : run the views in isolated environment and add access to specific namespaces.


Solution

  • There is a project called RazorEngine, built upon Microsoft's Razor, that allows you to parse that syntax without being in the context of returning an MVC view. Here's how it's used:

     string template = "Hello @Model.Name! Welcome to Razor!";
     string result = Razor.Parse(template, new { Name = "World" });
    

    You can also specify a customized template base, which should allow you to define only the Html Helpers you want to expose to your users:

     Razor.SetTemplateBase(typeof(HtmlTemplateBase<>));
    
     string template = 
      @"<html>
          <head>
            <title>Hello @Model.Name</title>
          </head>
          <body>
            Email: @Html.TextBoxFor(m => m.Email)
          </body>
        </html>";
    
      var model = new PageModel { Name = "World", Email = "someone@somewhere.com" };
      string result = Razor.Parse(template, model);