1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
//------------------------------------------------------------------------------
// <copyright file="EncoderUtil.cs" company="Microsoft">
// Copyright (c) Microsoft Corporation. All rights reserved.
// </copyright>
//------------------------------------------------------------------------------
namespace System.Web.Security.AntiXss {
using System;
using System.Text;
/// <summary>
/// Provides helper methods common to all Anti-XSS encoders.
/// </summary>
internal static class EncoderUtil {
/// <summary>
/// Gets an appropriately-sized StringBuilder for the output of an encoding routine.
/// </summary>
/// <param name="inputLength">The length (in characters) of the input string.</param>
/// <param name="worstCaseOutputCharsPerInputChar">The worst-case ratio of output characters per input character.</param>
/// <returns>A StringBuilder appropriately-sized to hold the output string.</returns>
internal static StringBuilder GetOutputStringBuilder(int inputLength, int worstCaseOutputCharsPerInputChar) {
// We treat 32KB byte size (16k chars) as a soft upper boundary for the length of any StringBuilder
// that we allocate. We'll try to avoid going above this boundary if we can avoid it so that we
// don't allocate objects on the LOH.
const int upperBound = 16 * 1024;
int charsToAllocate;
if (inputLength >= upperBound) {
// We know that the output will contain at least as many characters as the input, so if the
// input length exceeds the soft upper boundary just preallocate the entire builder and hope for
// a best-case outcome.
charsToAllocate = inputLength;
}
else {
// Allocate the worst-case if we can, but don't exceed the soft upper boundary.
long worstCaseTotalChars = (long)inputLength * worstCaseOutputCharsPerInputChar; // don't overflow Int32
charsToAllocate = (int)Math.Min(upperBound, worstCaseTotalChars);
}
// Once we have chosen an initial value for the StringBuilder size, the StringBuilder type will
// efficiently allocate additionally blocks if necessary.
return new StringBuilder(charsToAllocate);
}
}
}
|
