.NET AntiXSS Library - Revision history

JV: /* Options */

2015-03-02T23:00:58Z

‎Options

2015-03-02T23:00:42Z

added HtmlSanitizer

2015-02-20T17:18:18Z

‎XSS References

2014-04-23T04:18:30Z

Adding attribution to the XSS Cheatsheet link

2014-04-23T04:07:55Z

2014-04-23T03:45:47Z

2014-04-15T13:47:26Z

2014-04-15T03:32:47Z

2014-04-15T02:49:04Z

2014-04-15T02:37:49Z

@@ Line 22: / Line 22: @@
 **Not recently maintained (good option for to get it up to date and relevant!!!)
 * HtmlSanitizer
-** A open-source .Net library.
+** An open-source .Net library.
 ** The HTML is cleaned with a white list approach.
 ** All allowed tags and attributes can be configured.

@@ Line 21: / Line 21: @@
 *OWASP Anti-Samy Library (https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project_.NET)
 **Not recently maintained (good option for to get it up to date and relevant!!!)
 == XSS References ==

@@ Line 30: / Line 30: @@
 * https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
 * [http://ha.ckers.org/xssAttacks.xml RSnake's XSS Cheatsheet] (in XML format; nice for programatic consumption!)
 * TODO add more references here -- Troy Hunt's material is excellent - I'm sure more people in the world have content which would be valuable here to reference...

@@ Line 29: / Line 29: @@
 * http://devproconnections.com/aspnet/microsoft-adds-antixss-tool-aspnet-45
 * https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
-* XSS Cheatsheet (in XML format; nice for programatic consumption!) http://ha.ckers.org/xssAttacks.xml
+* [http://ha.ckers.org/xssAttacks.xml RSnake's XSS Cheatsheet] (in XML format; nice for programatic consumption!)
 * TODO add more references here -- Troy Hunt's material is excellent - I'm sure more people in the world have content which would be valuable here to reference...

@@ Line 5: / Line 5: @@
 Cross site scripting (XSS) continues to show up on the [[Category:OWASP_Top_Ten_Project|OWASP Top Ten Project]] as a top vulnerability every year.  While very pervasive and dangerous, this vulnerability is possible to mitigate with reasonable developer effort.  This page is dedicated to helping mitigate this vulnerability in regards to the Microsoft .NET Framework.
-== Challenges ==
+== Attack Vectors ==
 The primary XSS attack vectors are:
 * Reflected XSS
 * Persistent XSS
 == Options ==
@@ Line 22: / Line 23: @@
 == XSS References ==
 * http://www.troyhunt.com/2010/05/owasp-top-10-for-net-developers-part-2.html
 * http://www.troyhunt.com/2011/12/free-ebook-owasp-top-10-for-net.html

@@ Line 25: / Line 25: @@
 * http://www.troyhunt.com/2011/12/free-ebook-owasp-top-10-for-net.html
 * http://pluralsight.com/training/Courses/TableOfContents/owasp-top10-aspdotnet-application-security-risks (NOTE: This is a subscription course from PluralSight - I am not advocating any website or product, but found this to be useful and informative)
-*http://devproconnections.com/aspnet/microsoft-adds-antixss-tool-aspnet-45
+* http://devproconnections.com/aspnet/microsoft-adds-antixss-tool-aspnet-45
 * TODO add more references here -- Troy Hunt's material is excellent - I'm sure more people in the world have content which would be valuable here to reference...
@@ Line 33: / Line 35: @@
 * See what work has already been done in the OWASP space for XSS
 * See what other work has been done for XSS (both .NET and other technology stacks)
-* Illustrate vulnerabilities and how to mitigate them (e.g. WebGoat)
+* Illustrate vulnerabilities and how to mitigate them (e.g. WebGoat.NET)
 * See if we can get the OWASP Anti-Samy project back into relevance

← Older revision		Revision as of 13:47, 15 April 2014
Line 1:		Line 1:
−	(NOTE:) This content is a work in progress and all contribution is welcome. Please contact ~~Jeff Knutson (~~[[User:Jeff Knutson]]) with questions, ideas, corrections, etc.	+	'''NOTE''': This content is a work in progress and all contribution is welcome. Please contact [[User:Jeff Knutson\|Jeff Knutson]] with questions, ideas, corrections, etc.

	== Overview ==		== Overview ==

@@ Line 3: / Line 3: @@
 == Overview ==
-Cross site scripting (XSS) continues to show up on the [[Category:OWASP_Top_Ten_Project|OWASP Top Ten Project]] as a top vulnerability.
+Cross site scripting (XSS) continues to show up on the [[Category:OWASP_Top_Ten_Project|OWASP Top Ten Project]] as a top vulnerability every year.  While very pervasive and dangerous, this vulnerability is possible to mitigate with reasonable developer effort.  This page is dedicated to helping mitigate this vulnerability in regards to the Microsoft .NET Framework.
 == Options ==
@@ Line 14: / Line 20: @@
 *OWASP Anti-Samy Library (https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project_.NET)
 **Not recently maintained (good option for to get it up to date and relevant!!!)
 == TODO ==

@@ Line 11: / Line 11: @@
 ***Using Microsoft AntiXSS as the default encoder in ASP.NET instructions (Phil Haack has a good link on this already:  http://haacked.com/archive/2010/04/06/using-antixss-as-the-default-encoder-for-asp-net.aspx/)
 *Microsoft Web Protection Library (WPL) - via http://wpl.codeplex.com/workitem/17246
 *OWASP Anti-Samy Library (https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project_.NET)
 **Not recently maintained (good option for to get it up to date and relevant!!!)
@@ Line 20: / Line 21: @@
 * See what other work has been done for XSS (both .NET and other technology stacks)
 * Illustrate vulnerabilities and how to mitigate them (e.g. WebGoat)
 === Future ===