Posts Tagged ‘’

ASP.NET and input validation against XSS

Friday, September 5th, 2008

The today’s topic is XSS under ASP.NET and how validation filters and request filters works and are applied under ASP.NET.

The Microsoft .NET framework comes with a request validation feature, configurable by the ValidateRequest setting. ValidateRequest has been a feature of ASP.NET since version 1.1. This feature consists of a series of filters, designed to prevent classic web input validation attacks such as HTML injection and XSS (Cross-site Scripting).

Procheckup describe how bypass ValidateRequest in a whitepaper.

On the other side, some ASP.NET controls offers by default automatic html encoding, a great resource when you are reviewing your code for possible Cross-Site Scripting (XSS) or double encoding problems is this table that list all ASP.NET control and which property offers html, script or url encoding.