2

I have a web application. I am using Angularjs and Web Api2.

I have a simple form where user can insert some free text that will be send via email to other people. The text is also saved on db and later can be shown in a web site page. I knew I didn't need to check the input of the user, because in web api, the text is automatically encoded. So I expected that if user, for example, type

<script type="..">...</script>

I receive server side, in my web api controller, something like this:

&lt;script type=&quot;..&quot;&gt;...&lt;/script&gt;

I receive instead 

<script type="..">...</script>

nothing changed.

How can I encode my input to be sure that the application do not receive XSS attack? Should I leave the input unchanged but change the value when I put it in the email? And when I save it in my database? It should saved in the form 

<script type="..">...</script>

and then encoded when I show it in the page?

In this moment I just added this in my web.config 

<httpRuntime ... encoderType="System.Web.Security.AntiXss.AntiXssEncoder,System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

But nothing seems to be changed.

Thank you

Simone
  • 2,304
  • 6
  • 30
  • 79

1 Answers1

2

You have multiple possibilities, you can encode the string data you received (https://github.com/mathiasbynens/he) before saving them into the DB, in this manner you don't need to do almost nothing displaying them, because they will displayed as a string like this &lt;script type=&quot;..&quot;&gt;...&lt;/script&gt; for example.

But if you still want to accept some html tags like <p>, <strong>, etc... you should save the input without encoding it and using a sanitizer to display them: https://docs.angularjs.org/api/ng/directive/ngBindHtml

michelem
  • 14,430
  • 5
  • 50
  • 66
  • I thought to use a solution server side, like AntiXss library, that now should be included in framework... so, you confirm me taht I effectly need to do some encodings? – Simone Jun 15 '15 at 09:29
  • 1
    If you plan to NOT sanitize the output when you will display the strings you must encode them before saving. Otherwise, you can save the raw string, and do some sanitization when you display them. – michelem Jun 15 '15 at 09:46