0

I'm dealing with a method to query web elements. and I want let users to choose which kind of elements They are want to choose. So I have Following code:

public static List<IWebElement> getItemsByType(IWebDriver driver, string typename, Expression<Func<IWebElement, bool>> expression)
{
   return driver.FindElements(By.TagName(typename)).ToList().AsQueryable().Where(expression).ToList();
}

Here is the expression sample:

Expression<Func<IWebElement, bool>> expression =  t => ((t.GetAttribute("type").ToString() == "button") && (t.FindElements(By.XPath("ancestor::table")).Count == 0));

For first step,I want to read this kind of lamda expression from textbox. The root issue is: How can I convert string to this kind of expression ?

Any help is appreciate !

Gaurang Dave
  • 3,956
  • 2
  • 15
  • 34
Mark Liu
  • 1
  • 2
    Allowing users to inject code is a _huge_ security risk... – Sweeper May 15 '18 at 05:30
  • @Sweeper,thanks for your suggestions. For further, I will use UI to generate this kind of string. But this issue is the biggest risk right now, I have no idea about whether it can be solved or not. – Mark Liu May 15 '18 at 05:57
  • 1
    Try to create your own syntax for the expressions and parse them. This way you can limit what people can do. – Sweeper May 15 '18 at 06:00
  • @Sweeper, Could you please share more information about create my own Syntax? as I'm using selenium inner methods to find the elements. seems custom syntax also faces the issue about converting string to expression. Am I in a wrong way? – Mark Liu May 15 '18 at 06:11
  • You still need to parse the expression, yes, but now you can limit what the user writes. You can just have 2 available "functions" - `GetAttribute` and `FindElementById`. If you were trying to parse and run C# code, then the user can write whatever they want in C#. – Sweeper May 15 '18 at 06:14

0 Answers0