Prevent Javascript in URL attacks (asp.net)

Question

I've seen plenty of Cross-Site Scripting attack prevention suggestions, but I'm not asking about Form Input validation. How would I prevent something like this:

javascript:(function(i,j){with(document){for(i=0;i<forms.length;++i){with(forms[i]){for(j=0;j<elements.length;++j){elements[j].disabled=false}}}}})()

from being inserted into the URL? This code would enable all form elements on a page if added to a URL. So if you disabled certain buttons based due to permissions or something then all those buttons would become enabled.

Should I just be parsing the URL and check for the Javascript keyword?

Answer 1

No. You can't, anyway, as it doesn't get sent to the server.

That is just JavaScript executed locally by the user themselves. It should mean nothing to you. The security of your system should never rely on client-side javascript, all your authentication, and so on, should be done server-side.

Answer 2

Are you concerned that this is added to the url when they go to your website, to enable everything?

If that is the case, then just have the javascript, using unobtrusive javascript, disable all that is supposed to be disabled.

You may want everything enabled if that is the best chance, if javascript is turned off.

This would prevent the attack you are talking about.

Answer 3

The key is to not worry much about it client-side. Server-side is where you have to be bullet-proof. Do not assume, for example, that just because you named your form inputs the same as your database column names, that you can just loop through Request.Form and persist all the data you get. You should validate that you only process the inputs you are expecting, and validate them for data type and range, as well as considering the user's permissions to alter a given field.

That way, the user can send whatever they want, you will only process and accept valid data server-side.