Samhammer.AspNetCore.StringTrimming 1.0.2

Samhammer.AspNetCore.StringTrimming

Trims leading and trailing whitespace of all string inputs of ASP.NET Core MVC, so controllers, validators and repositories don't have to deal with it.

Only reading is affected. Responses are serialized unchanged.

Packages

The two serializer packages don't depend on each other. Install exactly one of them; the common package comes with it.

How to use

System.Text.Json:

builder.Services.AddControllers()
    .AddJsonOptions(...)
    .AddSystemTextJsonStringTrimming();

Newtonsoft.Json:

builder.Services.AddControllers()
    .AddNewtonsoftJson(...)
    .AddNewtonsoftJsonStringTrimming();

Both are applied with PostConfigure, so the order relative to AddJsonOptions() / AddNewtonsoftJson() does not matter. Both register the model binder of the common package.

Without MVC (e.g. your own serializer settings):

var options = new JsonSerializerOptions().AddStringTrimming();          // System.Text.Json
var settings = new JsonSerializerSettings().AddStringTrimming();        // Newtonsoft.Json

Opt-out with [NoTrim]

Use [NoTrim] where whitespace is meaningful (markdown, templates, regex, secrets, signatures):

public class MessageContract
{
    public string Title { get; set; }       // trimmed

    [NoTrim]
    public string Markdown { get; set; }    // kept as sent
}

public IActionResult Get([FromQuery][NoTrim] string pattern) { ... }

public record SignedLink(string Email, [property: NoTrim] string Signature);

Behavior

• string.Trim() is used: all Unicode whitespace incl. line breaks and NBSP; zero-width characters and BOM (U+FEFF) are not removed.
• JSON: null stays null, whitespace-only becomes "".
• Route, query, form: like the default binder, empty or whitespace-only values become null (ConvertEmptyStringToNull).
• Trimmed: properties, fields, constructor parameters, items of string collections, values of string dictionaries. Dictionary keys and property names are not trimmed.
• Not trimmed: strings inside object, JToken, JsonElement or dynamic, raw Request.Body reads, IFormFile content, headers.
• Only ASP.NET Core MVC (controllers) is covered. Minimal API endpoints (app.MapPost(...)) are not trimmed: they read JSON with Microsoft.AspNetCore.Http.Json.JsonOptions (always System.Text.Json) and do not use the MVC model binders. For JSON bodies of Minimal APIs, add the converter there yourself: builder.Services.ConfigureHttpJsonOptions(o => o.SerializerOptions.AddStringTrimming()); (route and query values stay untrimmed).

System.Text.Json

• A global JsonConverter<string> trims every string, including root values ([FromBody] string) and items of any collection.
• [NoTrim] is applied by a type info modifier. If you replace TypeInfoResolver (e.g. source generated contexts) after the trimming was added, the modifier is lost.

Newtonsoft.Json

• Uses TrimStringContractResolver instead of a converter for string. A converter would change how Newtonsoft.Json reads strings (date-like strings would be parsed and reformatted, numbers would no longer be accepted for string properties). With the resolver, strings are read as usual and trimmed afterwards.
• The existing contract resolver is replaced, keeping its settings. Supported: DefaultContractResolver (ASP.NET Core default, camel case), CamelCasePropertyNamesContractResolver. A custom resolver must derive from TrimStringContractResolver, otherwise an InvalidOperationException is thrown.
• Supported string collections: string[], List<string>, IEnumerable<string>, IList<string>, ICollection<string>, IReadOnlyList<string>, IReadOnlyCollection<string> and concrete ICollection<string> types with a default constructor (e.g. HashSet<string>). Dictionaries: Dictionary<string, string>, IDictionary<string, string>, IReadOnlyDictionary<string, string> and concrete types with a default constructor.
• Not trimmed: a string as root value ([FromBody] string).

Things to check when introducing it

• Values that are hashed, signed or compared byte-exact (checksums, signatures, passwords, cache keys).
• Values where whitespace is meaningful (markdown, code, templates, regex, separators).
• Existing data is not migrated: values stored before keep their whitespace.
• Service-to-service calls go through the same pipeline and are trimmed as well.

Build and release

One pipeline (.github/workflows/cicd.yaml) builds and tests all projects. Pushing a tag (e.g. 1.0.0) publishes all three packages to NuGet with the tag as version, so the packages always share the same version.