Security implications of escaping / reforming html in asp.net (working around validateRequest)

Question

I'm having asp.Net barf at me when I submit the a form with a value like <a_ (underscore is a space). This is bad - at the very least I want to be able to gracefully handle the error, ideally I'd like the user to be able to submit anything they like and have it work as the user expects.

• I could set validateRequest="false" in the web.config, but I don't want to because I don't understand the security implications.
• This article suggested using JavaScript to escape html, and then re-forming the html server side, however I also wasn't sure what the security implications of that was - is this not just the same as setting validateRequest="false" for that control?

Answer 1

Best to do the javascript thing.

What do you do with the submitted information?

If you are going to display it on the screen for other users you are opening yourself up XSRF pretty badly.

This could lead to a variety of things, from mangling the content of your pages (bit like graffiti on your shop window) to session hijacking and much worse.

some info on XSRF attacks:

http://webpangea.blogspot.com/2009/05/xsrf-attacks-far-too-easy.html

Answer 2

Bypass away. ValidateRequest is just a weak attempt to prevent XSS attacks. While it is a valid attempt, it results in halfassed security and confused developers.

The crux of the thing is to help prevent javascript from being sent to the host, only to be blindly served back up to one or more clients. You can prevent this by HtmlEncoding anything you display in a webpage, which is what you should be doing in the first place instead of relying on ValidateRequest.

My suggestion:

1. Learn up on XSS attacks
2. Get rid of ValidateRequest
3. Use the Anti-XSS library in its place