Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 273Use the following countermeasures to prevent XSS attacks:●●Validate inputEncode outputValidate InputValidate any input that is received from outside your application’s trust boundary fortype, length, format, and range using the various techniques described previously inthis chapter.Encode OutputIf you write text output to a Web page and you do not know with absolute certaintythat the text does not contain HTML special characters (such as , and &), thenmake sure to pre-process it using the HttpUtility.HtmlEncode method. Do this evenif the text came from user input, a database, or a local file. Similarly, useHttpUtility.UrlEncode to encode URL strings.The HtmlEncode method replaces characters that have special meaning in HTML toHTML variables that represent those characters. For example, < is replaced with &ltand " is replaced with &quot. Encoded data does not cause the browser to executecode. Instead, the data is rendered as harmless HTML.Response.Write(HttpUtility.HtmlEncode(Request.Form["name"]));Data-Bound ControlsData-bound Web controls do not encode output. The only control that encodes outputis the TextBox control when its TextMode property is set to MultiLine. If you bindany other control to data that has malicious XSS code, the code will be executed onthe client. As a result, if you retrieve data from a database and you cannot be certainthat the data is valid (perhaps because it is a database that is shared with otherapplications), encode the data before you pass it back to the client.Sanitizing Free Format InputIf your Web page includes a free-format text box, such as a “comments” field, inwhich you want to permit certain safe HTML elements such as and , you canhandle this safely by first pre-processing with HtmlEncode, and then selectivelyremoving the encoding on the permitted elements, as follows:StringBuilder sb = new StringBuilder( HttpUtility.HtmlEncode(userInput) ) ;sb.Replace("&lt;b&gt;", "");sb.Replace("&lt;/b&gt;", "");sb.Replace("&lt;i&gt;", "");sb.Replace("&lt;/i&gt;", "");Response.Write(sb.ToString());