19

I recently noticed that I had a big hole in my application because I had done something like:

<input type="text" value="<%= value%>" />

I know that I should have used Html.Encode, but is there any way to do that for all values, without having to do it explicitly?

tghw
  • 25,208
  • 13
  • 70
  • 96

5 Answers5

22

There's a few ways:

  • Use the <%: %> syntax in ASP.NET MVC2 / .NET 4.0. (Which is just syntactic sugar for Html.Encode())
  • Follow the directions laid out by Phil Haack where it details using the Anti-XSS library as the 'default' encoding engine for ASP.NET.
George Stocker
  • 57,289
  • 29
  • 176
  • 237
9

Watch this video from Scott Hanselman and Phil Haack. They cover XSS, CSRF, JSON Hijacking specifically with ASP.Net MVC.

Simon
  • 2,449
  • 2
  • 18
  • 20
BradB
  • 977
  • 1
  • 8
  • 14
7

In ASP.Net 4.0 or later, always use <%: ... %> instead of <%= ... %> ... it does the HTML encoding for you.

Scott Gu's explanation.

Having done that, it's fairly straightforward to grep your code for <%= regularly as a security precaution.

Also, are you using the Microsoft Anti-XSS library?

Joel Spolsky
  • 33,372
  • 17
  • 89
  • 105
2

Syntax for HTML encoding

  1. <%: model.something %> syntax in WebForms

  2. It is automatic in Razor i.e. @model.something will auto encode automatically no need to do anything to encode.

  3. MVC3 HTML Helper methods return the encoded string automatically. e.g. Html.Label will return the encoded string

More about cross site scripting

http://thirum.wordpress.com/2013/10/24/how-asp-net-mvc-prevents-cross-site-scriptingxss-attack/

Thiru
  • 407
  • 5
  • 7
1

Potentially Dangerous HTML Tags:

While not an exhaustive list, the following commonly used HTML tags could allow a malicious user to inject script code:

<applet>
<body>
<embed>
<frame>
<script>
<frameset>
<html>
<iframe>
<img>
<style>
<layer>
<link>
<ilayer>
<meta>
<object>

An attacker can use HTML attributes such as src, lowsrc, style, and href in conjunction with the preceding tags to inject cross-site scripting. For example, the src attribute of the tag can be a source of injection, as shown in the following examples.

<img src="javascript:alert('hello');">
<img src="java&#010;script:alert('hello');">
<img src="java&#X0A;script:alert('hello');">

An attacker can also use the tag to inject a script by changing the MIME type as shown in the following.

<style TYPE="text/javascript">
  alert('hello');
</style>
Brad Larson
  • 170,088
  • 45
  • 397
  • 571
Peter Selth
  • 11
  • 1
  • You may want to use a whitelist approach instead of a blacklist approach. Also consider attributes such as `onclick`, `onblur` and `onhover`. – Fred Jun 15 '16 at 09:49