Securing against JS injection with ASP.NET MVC

Question

I would like to allow users to post HTML to a site but need to ensure that no Javascript is injected into the site.

So far I have created a validation attribute to check the incoming html for dodgy doings

[AttributeUsage(AttributeTargets.Property, 
    AllowMultiple = false, Inherited = true)]
public class CheckHtml : ValidationAttribute, IMetadataAware {

    private static Regex _check = new Regex(
        @"<script[^>]*>.*?<\/script>|<[^>]*(click|mousedown|mouseup|mousemove|keypress|keydown|keyup)[^>]*>",
        RegexOptions.Singleline|RegexOptions.IgnoreCase|RegexOptions.Compiled);

    protected override ValidationResult IsValid(
        object value, ValidationContext validationContext) {

        if(value!=null
            && _check.IsMatch(value.ToString())){

            return new ValidationResult("Content is not acceptable");
        }

        return ValidationResult.Success;
    }

    /// <summary>
    /// <para>Allow Html</para>
    /// </summary>
    public void OnMetadataCreated(ModelMetadata metadata) {
        if (metadata == null) {
            throw new ArgumentNullException("metadata");
        }
        metadata.RequestValidationEnabled = false;
    }
}

Is this going to be enough? What do you do to check for such naughtyness?

sanderd · Accepted Answer · 2011-02-16 12:30:17Z

3

Take a look at the Microsoft AntiXSS library. It boasts a AntiXSS.GetSafeHtmlFragment() method which returns the HTML stripped of all the XSS-badness.

As David has pointed out, a white list is always the way to go. AntiXSS uses a whitelist of HTML elements/attributes that are safe against XSS / filters out JavaScript.

answered Feb 16, 2011 at 12:30

sanderd

8094 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Quentin · Accepted Answer · 2011-02-16 12:02:58Z

2

Is this going to be enough?

No. It is a blacklist. A blacklist is never enough.

No. It is a regular expression. Regular expressions are rubbish at dealing with arbitrary HTML.

What do you do to check for such naughtyness?

A proper HTML parser combined with a whitelist.

answered Feb 16, 2011 at 12:02

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Comments

Shakakai · Accepted Answer · 2011-02-16 11:58:05Z

0

Jeff Atwood had a nice discussion of this topic over on refactor my code. Definitely worth the time to check it out: http://refactormycode.com/codes/333-sanitize-html

The final refactored version should be pretty solid. Security is never a 100% type of thing but this is probably better than most other examples floating around.

answered Feb 16, 2011 at 11:58

Shakakai

3,5642 gold badges18 silver badges18 bronze badges

1 Comment

Anthony Johnston Over a year ago

thanks, the white-list would have to be updated for html5, but that's a great start

Collectives™ on Stack Overflow

Securing against JS injection with ASP.NET MVC

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related