Remove random XSS code

Author: pranavkm

docs/3. Add front-end, render agenda, set up front-end models.md

@@ -364,11 +364,6 @@ In this session, we'll add the front end web site, with a public (anonymous) hom
 
         DayOffset = Session.StartTime?.Subtract(startDate ?? DateTimeOffset.MinValue).Days;
 
-        if (!string.IsNullOrEmpty(Session.Abstract))
-        {
-            Session.Abstract = "<p>" + String.Join("</p><p>", Session.Abstract.Split("\r\n", StringSplitOptions.RemoveEmptyEntries)) + "</p>";
-        }
-
         return Page();
     }
    ```
@@ -391,31 +386,9 @@ In this session, we'll add the front end web site, with a public (anonymous) hom
         <em><a asp-page="Speaker" asp-route-id="@speaker.ID">@speaker.Name</a></em>
     }
 
-    <p>@Html.Raw(Model.Session.Abstract)</p>
-   ```
-
-## HTML Encoding the Session Abstract
-Currently, the *Session* Abstract is displayed using `@Html.Raw()`. This makes it vulnerable to Cross-Site Scripting (XSS) and Injection Attacks, since an abstract could contain JavaScript. We'll update `Session.cshtml.cs` to HTML encode the Abstract to protect against these attacks.
-
-1. Add an `HtmlEncoder` field to the `SessionModel` using the following code:
-   ```csharp
-   private readonly HtmlEncoder _htmlEncoder;
-   ```
-1. Update the `SessionModel` constructor to inject an `HtmlEncoder`:
-   ```csharp
-    public SessionModel(IApiClient apiClient, HtmlEncoder htmlEncoder)
-    {
-        _apiClient = apiClient;
-        _htmlEncoder = htmlEncoder;
-    }
-   ```
-1. Update the section of the `OnGet()` method that handles `Session.Abstract` to encode the output.
-   ```csharp
-    if (!string.IsNullOrEmpty(Session.Abstract))
+    @foreach (var para in Model.Session.Abstract.Split("\r\n", StringSplitOptions.RemoveEmptyEntries))
     {
-        var encodedCrLf = _htmlEncoder.Encode("\r\n");
-        var encodedAbstract = _htmlEncoder.Encode(Session.Abstract);
-        Session.Abstract = "<p>" + String.Join("</p><p>", encodedAbstract.Split(encodedCrLf, StringSplitOptions.RemoveEmptyEntries)) + "</p>";
+       <p>@para</p>
     }
    ```