ASP.NET MVC Dynamic External URL

Question

I have a site where users can supply a URL of their choice.

I'm sure it's a security hole so what should I do to tighten that down without losing too much flexability?

If I were to leave it, how could I render a link or build a route such that I could link users externally? This doesn't work (of course):

<a href="@item.Location" target="_self">@item.Title</a>

Web browsers allow users to supply a URL of their choice too. :) — Russell
– Russell, Commented Dec 6, 2011 at 8:15
Agreed :) However, there is a business need to provide helpful links to people coming to this page. — Benny
– Benny, Commented Dec 6, 2011 at 8:19
The best place to ensure that user-provided URLs don't mess with the site is when validating input. This way, URIs like javascript:alert("Wat!") can be disallowed without removing the protocol-part of the URL. Users should have the freedom to choose between giving http:// or https:// URLs, for example. — sshine
– sshine, Commented Aug 13, 2015 at 13:26

Florent · Accepted Answer · 2012-10-11 12:55:00Z

7

Append protocol before @item.URL like this:

<a href="http://@item.URL" target="_blank">@Html.DisplayFor(modelItem => item.Title)</a>

Florent

12.4k10 gold badges51 silver badges58 bronze badges

answered Jul 30, 2012 at 16:07

Max Becerra

48612 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1