5

Spoiled by Ruby on Rails (3), I expect all my HTML output to be automatically encoded.

I asked this question about script exploits a bit earlier and am now wondering, is there some setting, plugin or extension for ASP.NET that will automatically cause all HTML to be HtmlEncode'ed or do I have to be really careful and ensure that on my own?

Community
  • 1
  • 1
Zabba
  • 64,285
  • 47
  • 179
  • 207

3 Answers3

5

Various ASP.NET controls automatically encode HTML with HtmlEncode (and a few do URL encoding with UrlEncode), but it's not universal. Here's a list of controls and what encoding (if any) they do automatically. I don't know if it's updated for .NET 4.0 or not:

Which ASP.NET Controls Automatically Encodes? (this link will ask you to save the document)

This is the blog that the above document is from:

http://blogs.msdn.com/b/sfaust/archive/2008/09/02/which-asp-net-controls-automatically-encodes.aspx

It was originally posted in Sep 2008, so it's probably current for 2.0, but not necessarily 4.0. Still a useful resource to have, though, IMO.

You should also look at the Microsoft Anti-Cross Site Scripting Library 3.1.

As pointed out by balexandre, it appears the Anit-XSS library is now part of the open source Web Protection Library:

Microsoft Web Protection Library

Also, OWASP is a good resource for security information, and they have an Enterprise Security API project (ESAPI) that is available (to varying degrees) in various programming languages. The .NET one is not complete yet, I believe.

OWASP Enterprise Security API

Tim
  • 28,212
  • 8
  • 63
  • 76
  • @balexandre, the anti-xss library is an open-source initiative, but is not supported/endorsed my M$? – Zabba Aug 21 '11 at 07:27
  • As far as I know, Microsoft's Anti-XSS Library is **not** open source, but it is definitely supported by (and developed by, I believe) Microsoft. – Tim Aug 21 '11 at 07:32
  • I assumed it was open source because @balexandre linked to [this](http://wpl.codeplex.com/) in when he edited your answer – Zabba Aug 21 '11 at 07:36
  • the **AntiXSS** library is open source and it's included in the **Microsoft Web Protection Library** @ http://wpl.codeplex.com/ – balexandre Aug 21 '11 at 07:36
  • @balexandre - That's version 4.0; I linked to version 3.1. Good to know that - thanks. – Tim Aug 21 '11 at 07:40
  • @Tim you should always aim for higher versions when it comes to security :) – balexandre Aug 21 '11 at 07:42
  • @balexandre - I agree completely, and thanks for sharing the link. I added it to the answer :) – Tim Aug 21 '11 at 07:43
3

If you're using ASP.NET 4.0 with WebForms, then using the code nugget <%: %> will automatically HtmlEncode the output. If you're using the Razor engine, then all data is HtmlEncoded by default.

Zabba
  • 64,285
  • 47
  • 179
  • 207
Erik Funkenbusch
  • 92,674
  • 28
  • 195
  • 291
  • Is Razor used with WebForms or with ASP.NET MVC? – Zabba Aug 21 '11 at 07:25
  • Razor is an Engine View, and No you can't have it on Webforms, hold... Yes you can ;) plz read --> http://www.hanselman.com/blog/MixingRazorViewsAndWebFormsMasterPagesWithASPNETMVC3.aspx – balexandre Aug 21 '11 at 07:46
1

By default, ASP.Net will not accept postbacks where a Inputcontrol contains html elements. This behaviour is set at a page level by the property ValidateRequest.

If you want to accept postbacks containing html, you need to set ValidateRequest to false and HtmlEncode the userinput yourself on the server before further proceeding

citronas
  • 19,035
  • 27
  • 96
  • 164
  • By "need" I mean "should". You can just disable EnableEventValidation and accept postbacks containing html and print them out to the user again (like in a comment system, for instance). So ASP.Net won't stop you by doing so, but in this case it would be best to HTMLEncode the userinput before printing it out again. – citronas Aug 21 '11 at 07:33
  • @citronas, you incorrectly referenced the EnableEventValidation property rather than ValidateRequest. EnableEventValidation is for a different set of functionality related to the values that ASP.NET will accept on postback in a dropdown list or other list control. I attempted to edit your answer to be correct but it was rejected. – Chris Porter Feb 21 '13 at 19:05
  • @Chris Porter: Thanks for pointing the issue out. I edited my answer. I actually saw your edit request, but apparently I wasn't able to accept your request because 3 out of 4 people rejected it. I gave you an upvote, so that you now have enough reputation to edited answers on your own ;) http://stackoverflow.com/privileges – citronas Feb 21 '13 at 21:08
  • @citronas, Thanks! I was this || close to getting so thanks for the bump!! – Chris Porter Feb 21 '13 at 23:12