ASP.NET MVC Validation of Script Tags

Question

I want to prevent a user from entering any <script> tags inside a textarea box I have called story using very similar code to this:

if (ArticleToCreate.story.Contains("<script>") == true)
                ModelState.AddModelError("Story", "No script tags allowed!");

Unfortunately this won't work because it's looking for <script> exactly as it is rather than looking for <script>some code</script> or some code`

Can anyone help? I want to use very similar code to as shown above and not any Service Layers or Model scripts. Thanks

Generally speaking trying to combat XSS attacks with your own rolled solution is rarely a good idea. A simple solution is to just HTML encode all user input (which you should be doing anyway and Razor does automatically for you). — Matt Greer
– Matt Greer, Commented Jan 13, 2011 at 18:49
I'm not looking for a secure solution just looking to check for these tags and then throw validation error if possible. — Cameron
– Cameron, Commented Jan 13, 2011 at 19:06

Craig Stuntz · Accepted Answer · 2011-01-13 18:57:59Z

3

By default, MVC won't allow this. If you explicitly allow it (e.g., with [ValidateInput(false)]), then you need to use a tool like the Microsoft Web Protection Library to sanitize the input.

answered Jan 13, 2011 at 18:57

Craig Stuntz

127k12 gold badges257 silver badges275 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

John Bledsoe · Accepted Answer · 2011-01-13 19:02:25Z

1

If you need to allow users to enter some HTML but not any HTML, I recommend investigating the Microsoft Web Protection Library, which includes methods for making user-entered HTML fragments "safe".

I agree with Matt Greer in saying that trying to create your own solution for recognizing illegal tags is a bad idea. There are so many attack vectors to inject script into HTML that you won't be able to guard against all of them. (See this XSS Cheat Sheet for a sampling, but it's out of date so there are probably more.)

answered Jan 13, 2011 at 19:02

John Bledsoe

17.8k5 gold badges45 silver badges60 bronze badges

Comments

Fagro Vizcaíno Salcedo · Accepted Answer · 2011-01-13 19:03:09Z

0

you can use html encoding to obtain what you are looking for, something like this.

<%: model.story %> <---------that would help you, im assuming that you are using asp.net mvc 2 if not you can use something like this:

<%=Html.Encode(Model.story)%> <-----that's for asp.net mvc but that's for server side validation you can always add you own client side validation.

edited Jan 13, 2011 at 19:03

answered Jan 13, 2011 at 18:56

Fagro Vizcaíno Salcedo

11 bronze badge

Collectives™ on Stack Overflow

ASP.NET MVC Validation of Script Tags

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related