ASP.NET Output Encoding - Revision history

Bill Sempf: Promoted

2014-11-26T16:37:29Z

Promoted

Bricex: /* References */

2014-11-12T14:32:10Z

‎References

Bricex: Including example inputs/outputs

2014-11-08T18:39:37Z

Including example inputs/outputs

Bricex: /* Encoding Output Values in Code */

2014-11-03T21:05:50Z

‎Encoding Output Values in Code

Bricex: /* Encoding Output Values in Code */

2014-11-03T21:03:46Z

‎Encoding Output Values in Code

Bricex: /* References */

2014-11-03T20:55:02Z

‎References

Bricex: Adding HTML encoding of data binding expressions in ASP.NET 4.5

2014-11-03T20:53:31Z

Adding HTML encoding of data binding expressions in ASP.NET 4.5

Bricex: /* Encoding Output Values in HTML markup */

2014-11-03T17:34:51Z

‎Encoding Output Values in HTML markup

Bricex at 17:34, 3 November 2014

2014-11-03T17:34:17Z

Bricex: Changing sub title

2014-11-03T14:17:32Z

Changing sub title

@@ Line 1: / Line 1: @@
-= DRAFT DOCUMENT - WORK IN PROGRESS =
+=Description=
 Cross-site scripting attacks exploit vulnerabilities in web page validation by injecting client-side script code. The script code embeds itself in response data, which is sent back to an unsuspecting user. In addition to validating input, any data retrieved from untrusted or shared sources should be encoded on output. For example: data retrieved from a database that may have had malicious input persisted to it.
-==Encoding Output Values in Code==
+=Encoding Output Values in Code=
 Use <code>Server.HtmlEncode</code> to encode untrusted data for use in HTML output:
 <pre>var encodedHtml = Server.HtmlEncode(untrustedData);</pre>
@@ Line 11: / Line 9: @@
 <pre>var url = "https://www.bing.com/search?q=" + HttpUtility.UrlEncode(untrustedData);</pre>
-==Encoding Output Values in HTML markup==
+=Encoding Output Values in HTML markup=
 Starting with ASP.NET 4.0 you can HTML encode values in markup with the <code><%: %></code> syntax, as shown below.
 <pre><span><%: untrustedData %></span></pre>
@@ Line 25: / Line 23: @@
 </pre>
-==IHtmlString==
+=IHtmlString=
 If you have model properties that are used to display raw HTML you should consider using the <code>HtmlString</code> and <code>MvcHtmlString</code> classes starting with .NET 4.0. These both implement the <code>IHtmlString</code> interface and will instruct ASP.NET to skip output encoding when using <code><%: model.Property %></code> or <code>@model.Property</code> in HTML markup. Converting a property on your view model from <code>String</code> to <code>MvcHtmlString</code> will instruct ASP.NET that HTML encoding has already been accounted for.
@@ Line 35: / Line 33: @@
 }</pre>
-==AntiXssEncoder==
+=AntiXssEncoder=
 By default the ASP.NET encoding methods use a black-listing technique that evaluates the string for a set of character combinations that may indicate presence of malicious script. A superior approach is to use a [[Input Validation Cheat Sheet#White_List_Input_Validation|white-listing technique]] for validation, which can be achieved using the Anti-Cross Site Scripting Library from Microsoft. Starting with ASP.NET 4.5 you can specify that the <code>AntiXssEncoder</code> from this library be used as the default encoder for you entire application using the <code>encoderType</code> setting in web.config as shown below.
 <pre><httpRuntime encoderType="System.Web.Security.AntiXss.AntiXssEncoder" /></pre>
@@ Line 44: / Line 42: @@
 In addition to the common <code>HtmlEncode</code> and <code>UrlEncode</code> methods, the Anti-Cross Site Scripting Library provides the following <code>AntiXssEncoder</code> methods for more specialized output encoding needs:
-===CssEncode===
+==CssEncode==
 Encodes the specified string for use in cascading style sheets (CSS). This method encodes all characters except those that are in the safe list, by using the CSS escape character (/) followed by up to six hexadecimal digits.
 {| class="wikitable"
@@ Line 54: / Line 52: @@
 |}
-===HtmlFormUrlEncode===
+==HtmlFormUrlEncode==
 Encodes the specified string for use in form submissions whose MIME type is "application/x-www-form-urlencoded". This method encodes all characters except those that are in the safe list. Characters are encoded by using %SINGLE_BYTE_HEX notation.
 {| class="wikitable"
@@ Line 64: / Line 62: @@
 |}
-===XmlAttributeEncode===
+==XmlAttributeEncode==
 Encodes the specified string for use in XML attributes, and is slightly more restrictive than XmlEncode below. This method encodes all characters except those that are in the safe list. Characters are encoded by using &#DECIMAL; notation.
 {| class="wikitable"
@@ Line 74: / Line 72: @@
 |}
-===XmlEncode===
+==XmlEncode==
 Encodes the specified string for use in XML. This method encodes all characters except those that are in the safe list. Characters are encoded by using &#DECIMAL; notation.
 {| class="wikitable"
@@ Line 84: / Line 82: @@
 |}
-==References==
+=References=
 *[http://blogs.msdn.com/b/cisg/archive/2008/08/28/output-encoding.aspx Output Encoding]
 *[http://msdn.microsoft.com/en-us/library/System.Web.HttpUtility_methods(v=vs.110).aspx HttpUtility Methods]
@@ Line 96: / Line 94: @@
 *[[ASP.NET Request Validation]]
-[[Category:OWASP .NET Project]][[Category:Stub]]
+[[Category:OWASP .NET Project]]

@@ Line 87: / Line 87: @@
 *[http://blogs.msdn.com/b/cisg/archive/2008/08/28/output-encoding.aspx Output Encoding]
 *[http://msdn.microsoft.com/en-us/library/System.Web.HttpUtility_methods(v=vs.110).aspx HttpUtility Methods]
 *[http://weblogs.asp.net/scottgu/new-lt-gt-syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2 New <%: %> Syntax for HTML Encoding Output in ASP.NET 4 (and ASP.NET MVC 2)]
 *[http://www.asp.net/aspnet/overview/aspnet-and-visual-studio-2012/whats-new#_Toc318097391 HTML Encoded Data-Binding Expressions]

@@ Line 35: / Line 35: @@
 }</pre>
-==Enhanced Encoding==
+==AntiXssEncoder==
 By default the ASP.NET encoding methods use a black-listing technique that evaluates the string for a set of character combinations that may indicate presence of malicious script. A superior approach is to use a [[Input Validation Cheat Sheet#White_List_Input_Validation|white-listing technique]] for validation, which can be achieved using the Anti-Cross Site Scripting Library from Microsoft. Starting with ASP.NET 4.5 you can specify that the <code>AntiXssEncoder</code> from this library be used as the default encoder for you entire application using the <code>encoderType</code> setting in web.config as shown below.
 <pre><httpRuntime encoderType="System.Web.Security.AntiXss.AntiXssEncoder" /></pre>
@@ Line 44: / Line 44: @@
 In addition to the common <code>HtmlEncode</code> and <code>UrlEncode</code> methods, the Anti-Cross Site Scripting Library provides the following <code>AntiXssEncoder</code> methods for more specialized output encoding needs:
 {| class="wikitable"
-|CssEncode
+|<code>alert('XSS Attack!');</code>
-|Encodes the specified string for use in cascading style sheets (CSS).
+|<code>alert\000028\000027XSS\000020Attack\000021\000027\000029\00003B</code>
 |-
-|HeaderNameValueEncode
+|<code>user@contoso.com</code>
-|Encodes a header name and value into a string that can be used as an HTTP header.
+|<code>user\000040contoso\00002Ecom</code>
 |-
-|HtmlAttributeEncode
+|<code>user@contoso.com</code>
-|Encodes and outputs the specified string for use in an HTML attribute.
+|<code>user%40contoso.com</code>
 |-
-|HtmlFormUrlEncode
+|<code><script>alert('XSSあAttack!');</script></code>
-|Encodes the specified string for use in form submissions whose MIME type is "application/x-www-form-urlencoded".
+|<code>&amp;lt;script&amp;gt;alert(&amp;apos;XSS&amp;#12354;Attack!&amp;apos;);&amp;lt;/script&amp;gt;</code>
-|-
+|}
-|JavaScriptStringEncode
-|Encodes a string for use in JavaScript.
+===XmlEncode===
-|-
+Encodes the specified string for use in XML. This method encodes all characters except those that are in the safe list. Characters are encoded by using &#DECIMAL; notation.
-|UrlPathEncode
+{| class="wikitable"
-|Encodes path strings for use in a URL.
+|<code>alert('XSS Attack!');</code>
-|-
+|<code>alert(&amp;#39;XSS&amp;#32;Attack!&amp;#39;);;</code>
 |-
-|XmlEncode
+|<code><script>alert('XSSあAttack!');</script></code>
-|Encodes the specified string for use in XML.
+|<code>&amp;lt;script&amp;gt;alert(&amp;apos;XSS&amp;#12354;Attack!&amp;apos;);&amp;lt;/script&amp;gt;</code>
 |}

@@ Line 9: / Line 9: @@
 Use <code>Server.UrlEncode</code> to encode untrusted data for use in the key/value pairs of a URL query string.
-<pre>var encodedUrl = Server.UrlEncode(untrustedData);</pre>
+<pre>var url = "https://www.bing.com/search?q=" + HttpUtility.UrlEncode(untrustedData);</pre>
 ==Encoding Output Values in HTML markup==

@@ Line 8: / Line 8: @@
 <pre>var encodedHtml = Server.HtmlEncode(untrustedData);</pre>
-Use <code>Server.UrlEncode</code> to encode untrusted data for use in constructing URLs
+Use <code>Server.UrlEncode</code> to encode untrusted data for use in the key/value pairs of a URL query string.
 <pre>var encodedUrl = Server.UrlEncode(untrustedData);</pre>

@@ Line 74: / Line 74: @@
 *[http://msdn.microsoft.com/en-us/library/System.Web.HttpUtility_methods(v=vs.110).aspx HttpUtility Methods]
 *[http://weblogs.asp.net/scottgu/new-lt-gt-syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2 New <%: %> Syntax for HTML Encoding Output in ASP.NET 4 (and ASP.NET MVC 2)]
 *[http://msdn.microsoft.com/en-us/library/system.web.ihtmlstring(v=vs.110).aspx IHtmlString Interface]
 *[http://stackoverflow.com/questions/2293357/what-is-an-mvchtmlstring-and-when-should-i-use-it What is an MvcHtmlString and when should I use it?]

@@ Line 13: / Line 13: @@
 ==Encoding Output Values in HTML markup==
 You can HTML encode the value in markup with the <code><%: %></code> syntax, as shown below.
-<pre><span><%: untrustedData%></span></pre>
+<pre><span><%: untrustedData %></span></pre>
 Or, in Razor syntax, you can HTML encode with <code>@</code>, as shown below.

@@ Line 3: / Line 3: @@
 ==Description==
 Cross-site scripting attacks exploit vulnerabilities in web page validation by injecting client-side script code. The script code embeds itself in response data, which is sent back to an unsuspecting user. In addition to validating input, any data retrieved from untrusted or shared sources should be encoded on output. For example: data retrieved from a database that may have had malicious input persisted to it.
 ==Encoding Output Values in Code==
@@ Line 74: / Line 71: @@
 *[http://www.microsoft.com/en-sg/download/details.aspx?id=43126 Microsoft Anti-Cross Site Scripting Library V4.3]
 *[http://msdn.microsoft.com/en-us/library/system.web.security.antixss.antixssencoder_methods(v=vs.110).aspx AntiXssEncoder Methods]
 [[Category:OWASP .NET Project]][[Category:Stub]]

@@ Line 21: / Line 21: @@
 <pre><span>@untrustedData</span></pre>
-==Preventing Double Encoding==
+==IHtmlString==
-You may run into a scenario where encoding values results in them becoming double encoded on output. ASP.NET provides the <code>HtmlString</code> and <code>MvcHtmlString</code> classes starting with .NET 4.0 which are designed to help. These both implement the <code>IHtmlString</code> interface which will instruct ASP.NET to not apply encoding within HTML markup when using <code><%: untrustedData %></code> or <code>@untrustedData</code>. Converting a property on your view model from <code>String</code> to <code>MvcHtmlString</code> will instruct ASP.NET that HTML encoding has already been accounted for.
+If you have model properties that are used to display raw HTML you should consider using the <code>HtmlString</code> and <code>MvcHtmlString</code> classes starting with .NET 4.0. These both implement the <code>IHtmlString</code> interface and will instruct ASP.NET to skip output encoding when using <code><%: model.Property %></code> or <code>@model.Property</code> in HTML markup. Converting a property on your view model from <code>String</code> to <code>MvcHtmlString</code> will instruct ASP.NET that HTML encoding has already been accounted for.
 <pre>public class User