How do you avoid XSS vulnerabilities in ASP.Net (MVC)?

Question

I recently noticed that I had a big hole in my application because I had done something like:

<input type="text" value="<%= value%>" />

I know that I should have used Html.Encode, but is there any way to do that for all values, without having to do it explicitly?

Answer 1

In ASP.Net 4.0 or later, always use <%: ... %> instead of <%= ... %> ... it does the HTML encoding for you.

Scott Gu's explanation.

Having done that, it's fairly straightforward to grep your code for <%= regularly as a security precaution.

Also, are you using the Microsoft Anti-XSS library?

Answer 2

There's a few ways:

• Use the <%: %> syntax in ASP.NET MVC2 / .NET 4.0. (Which is just syntactic sugar for Html.Encode())
• Follow the directions laid out by Phil Haack where it details using the Anti-XSS library as the 'default' encoding engine for ASP.NET.

Answer 3

Watch this video from Scott Hanselman and Phil Haack. They cover XSS, CSRF, JSON Hijacking specifically with ASP.Net MVC.