Preventing / understanding xss with javascript encoding

Question

I'm currently reading up on .net MVC and have just reached the security chapter of the book. I've known about xss, and I never trust any user input without sanitizing it first (usually with html encoding or even something like php's strip_tags). Up until this point I was not familiar with Javascript encoding strings for protection. One of the examples in the book had a user pass in a string like:

\x3cscript\x3e%20alert(\x27test\x27)\x3c/script\x3e

So naturally when I learn something new I want to test it. I created this:

public ActionResult Index()
    {
        ViewBag.test = "\x3cscript\x3e%20alert(\x27test\x27)\x3c/script\x3e";
        return View("index");
    }

and this view code that prints out the test string on the page:

@ViewBag.test

However, I cannot get this alert box to show at all. When I view source on the page I get

&lt;script&gt;%20alert(&#39;test&#39;)&lt;/script&gt;

I've tried playing with it a few different ways

Passing the @ViewBag from a query string
putting the viewbag print inside of existing script code (this is how the book had it)
Replacing the %20 with actual spaces
Using jquery to replace html with ViewBag.test:
$('#inject_here').html('@ViewBag.test');

Nothing I try will execute this code (which I guess is a good thing?). Now I know there wouldn't be a portion of this book dedicated to something that didn't work in the first place, so the problem must be on my end. I just don't know what it is. Any one have any ideas?

Daniel Moses · Accepted Answer · 2013-05-30 21:06:01Z

1

asp.net MVC tries to take care of this issue for you. It automatically encodes output. You must go out of your way to print out a string without html encoding it.

@Html.Raw(ViewBag.test)

There are places where you will end up doing this in an application. Ideally you would have templates that models are rendered into. But, in some cases you'll have sections of HTML that are dynamic and need to be printed as is. In those cases you'll use the Html.Raw and just need to be aware that you must validate the sanity of the content.

edited May 30, 2013 at 21:06

answered May 30, 2013 at 21:00

Daniel Moses

5,86828 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

CountMurphy Over a year ago

You're right. turns out this portion of the book was only showing conceptual examples of xss, not working code. Guess I skipped over that part :/

Collectives™ on Stack Overflow

Preventing / understanding xss with javascript encoding

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related