Part 56 How to prevent cross site scripting attack

Link for code samples used in the demo

Healthy diet is very important both for the body and mind. If you like Aarvi Kitchen recipes, please support by sharing, subscribing and liking our YouTube channel. Hope you can help.

Make sure to replace [ with LESSTHAN and ] with GREATERTHAN symbol.

In this video, we will discuss preventing XSS while allowing only the HTML that we want to accept. For example, we only want to accept BOLD and UNDERLINE tags.

To achieve this let's filter the user input, and accept only BOLD and UNDERLINE tags. The following code,
1. Disables input validation
2. Encodes all the input that is coming from the user
3. Finally we selectively replace, the encoded html with the HTML elements that we want to allow.
[HttpPost]
// Input validation is disabled,
// so the users can submit HTML
[ValidateInput(false)]
public ActionResult Create(Comment comment)
{
StringBuilder sbComments = new StringBuilder();

// Encode the text that is coming from comments textbox
sbComments.Append(HttpUtility.HtmlEncode(comment.Comments));

// Only decode bold and underline tags
sbComments.Replace("<b>", "[b]");
sbComments.Replace("</b>", "[/b]");
sbComments.Replace("<u>", "[u]");
sbComments.Replace("</u>", "[/u]");
comment.Comments = sbComments.ToString();

// HTML encode the text that is coming from name textbox
string strEncodedName = HttpUtility.HtmlEncode(comment.Name);
comment.Name = strEncodedName;

if (ModelState.IsValid)
{
db.Comments.AddObject(comment);
db.SaveChanges();
return RedirectToAction("Index");
}

return View(comment);
}

Warning: Relying on just filtering the user input, cannot guarantee XSS elimination. XSS can happen in different ways and forms. This is just one example. Please read MSDN documentation on XSS and it's counter measures.

[isai]

Most teachers never talk about OWASP and how to prevent it. You are a great teacher, and you master the art of explaining complex concepts in a simple way. Congratulations and greetings from Mexico!

[Csharp-video-tutorialsBlogspot]

Thank you very much for taking time to give feedback. For email alerts, when new videos are uploaded, please subscribe to my channel. In the description of this video, I have included the link for ASP .NET, C#, and SQL Server playlists. All the videos are arranged in logical sequence in these playlists, which could be useful to you. Please share the link with your friends who you think would also benefit from them. If you like these videos, please click on the THUMBS UP button below the video.

[Csharp-video-tutorialsBlogspot]

Hi Akhil, sure, serialization is very important, and I will cover it as soon as I can.

[mdigbazova]

Thank you very much for all your tutorials! They are greatest in their areas in all YouTube Channel on my opinion!

[krismaly]

This is an interesting video. I think it is very useful for developers and I recommend to watch every developer.
StringBuilder explanation I liked.
Giving guidelines for reference like MSDN for cross scripting attack is good for user. I think you should put that link in your blog for ref. this is only suggestion.
Thanks a bunch

[amift]

Thanks very much, great explanation, very simple to understand & digest.

[priyansusachan]

hello kudvenkat, your tutorials are really helping in positive way. thanks for all your effort. but i have an question here, After taking the input from user you are manually replacing the encoded html to html string after doing that you are converting the string builder object to string type(sbComments.ToString()). And you have already defined that string of type System.string is automatically html encoded(While creating custom html helper Part48). So how come sbComments.ToString() is not getting html encoded again. Please clarify this doubt, I will be very helpful to you. Thanks.

[nehabhl]

Hi @kudvenkat, I tried this HTMLUtility.Encode(), this encoded field value before saving to DB. when after saving, when reopening the saved form, data is coming as encoded format and not like normal script. Can you tell me why? Do I need to add decoding as well? but you didn't add it?

[sksubhi]

can you please help me with HTML injection code, after enter data in textbox then tried to change data through inspect need solution after inspect should not be change textbox value or how I can check first textbox value and after inspect value in asp C# webform

[akhilb]

Hi Venkat, Thank you very much for sharing valuable knowledge with us. Recently i have faced one interview, most of the questions from different types of serialization, And class has to implement which interface to serialize? .and which method is invoked after serialization.how serialization linked with Generics.Please cover the serialization topics if you have a time
Thanks Venkat

[sachingreat]

Sir this video is one of the best video.

[cyber_india]

Hi, can you tell me how to prevent xss in perl ?

[balasubramanianramamoorthi]

How to stop PDF Injection that leads to Cross-site Scripting in mvc?

[gopub]

I am sorry to say that this technique is NOT good. What if, you want to display the database data in Mobile apps/Windows forms.Encoded values should never be stored in a database

[stagge]

Hallo, nicw video, can you give an exampel of file uplode for mvc

[anomalii]

Good job, but I hate the many "You Know" !!!