dotnet / dotnet/aspnetcore

Razor HTML Encoding Behaves Differently Inside Function Parameter vs Variable Assignment in `<script>` Block

Open
#65,767 2 comments 0 reactions 0 assignees View on GitHub
area-mvc untriaged
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

**Describe the bug:**

When embedding a Razor model expression inside a `` block, `@Model.General.Title` produces different rendered output depending on whether it appears in a **variable assignment** vs directly as an **inline function parameter object**.

When the model value contains a double quote (`"`), the variable assignment case renders `&quot;` (HTML-encoded), which keeps the JavaScript valid. The inline case renders a raw `"`, which breaks the JavaScript string and throws a syntax error.

This is unexpected — Razor should apply the same encoding regardless of surrounding JavaScript syntax.

---

**Version used:**

- .NET 8
- ASP.NET Core MVC / Razor `.cshtml`
- Browser: Chrome

---

**To reproduce:**

Given `Model.General.Title = badr "` (a string containing a double quote):

**Case 1 — Variable assignment (works ✅):**

```cshtml
<script>
var x = {
productTitle: "@Model.General.Title",
numberOfPayments: @Model.NumberOfPayments
};

productApi.initializeProductDetails(x);

```

Rendered output:

```html

var x = {
productTitle: "badr &quot;",
numberOfPayments: 11
};

productApi.initializeProductDetails(x);

```

✅ JS executes without error. `"` is treated as a literal string by the JS engine.

---

**Case 2 — Inline function parameter (breaks ❌):**

```cshtml

productApi.initializeProductDetails({
productTitle: "@Model.General.Title",
numberOfPayments: @Model.NumberOfPayments
});

```

Rendered output (suspected — raw HTML source not yet captured):

```html

productApi.initializeProductDetails({
productTitle: "badr "",
numberOfPayments: 11
});

```

❌ JS throws a syntax error. The `"` terminates the string early.

> **Note:** Raw HTML source via View Page Source still needs to be captured for Case 2 to confirm the exact rendered output. DevTools Inspect is not reliable here as the browser DOM decodes HTML entities.

---

**Expected behavior:**

`@Model.General.Title` should render identically in both positions. The surrounding JavaScript syntax (variable assignment vs function argument) should have no influence on how Razor encodes the expression output.

---

**Actual behavior:**

Case 1 renders `"` → JavaScript survives.
Case 2 renders `"` → JavaScript breaks with a syntax error.

Contributor guide

Open the contributing guide

Research direction

Start with the two Razor .cshtml reproductions in the issue and capture the raw HTML source for the inline function-parameter case, since its output is currently only suspected. Compare the generated output for both forms and trace how Razor encodes the model expression in each context. Done means the behavior is confirmed and the encoding is consistent without breaking the JavaScript.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.