Is there a simple way in C#/ASP.NET to validate that user input is a URL to guard against XSS attacks?

Question

We've got an interstitial page that warns people when they're leaving our site. The trouble is it takes querystring parameters and blindly generates a page, thus it's vulnerable to XSS attacks. I've been tasked with fixing it and I want to do it right.

Answer 1

Yes, try this:

if(Uri.IsWellFormedUriString(url, UriKind.Absolute) && url.StartsWith("http"))
    Response.Write(string.Format("<a href=\"{0}\">{0}</a>",
        HttpUtility.HtmlEncode(url)));

Answer 2

You should call Server.HtmlEncode to properly escape your generated HTML.

Answer 3

One solution is to store the destination urls in a database or other data store that cannot be accessed from the internet. Then you could pass a key value to the interstitial warning page in the query string and have the page read the url from your database on the server side.

Answer 4

So things not to do;

1. Use regex
2. Use HtmlEncode without thought.

Things to do;

1. Treat all input as untrusted.
2. Encode input before it is output. However make sure you're using the right type of encoding. If you put user input in an attribute then you use HtmlAttributeEncode, if it's just HTML then you use HtmlEncode, if you put it into JavaScript then it's JavaScriptEncode. If your javascript puts it into a div then it's HtmlEncode, followed by JavaScriptEncode.
3. Consider using AntiXSS which provides more encoding mechanisms and uses a safe list approach which is inherently safer.
4. Whitelist the exit URLs so people cannot use this page as an open referrer. Do not have a parameter which has the URL, rather have a GUID which looks up the URL from a database, session table or whatever.

(Disclosure : I own AntiXSS)

Answer 5

The best way is to get rid of the page entirely and just accept that its a website and make it act like a website. Websites link to other resources, it's why the web has over 200million sites instead of about a dozen.

Failing that, your best bet is to start with HtmlEncoding as a quick fix, and then replacing it with a lookup of ids to bring one to different sites.

But really, those "ZOMG you are leaving!" pages are horrible. They're even worse than the sites that open new tabs for every so-called "external" link.