CODEWITHSUNDEEP
asp.netsecurityxss
m0g
m0g

Reputation: 969

HttpRequestValidationException and cross-site scripting XSS

By using HttpRequestValidationException, does it necessarily protect you against all cross-scripting threats?

Are there situations where a potentially dangerous script might manage to go undetected?

Upvotes: 2

Views: 1424

Answers (2)

Erlend
Erlend

Reputation: 4416

No, in short it doesn't. Please decompile it using reflector and see what it does. An attack on an html attribute could be: " onfocus=alert(1) autofocus There are no < or > in this yet it still works. Please use AntiXss and check the OWASP XSS prevention cheat sheet. So you need to pay attention especially whenever you are using unescaped attributes like Literal.

Upvotes: 2

rick schott
rick schott

Reputation: 20617

Yes, in short it does. It can't do everything related to XSS, like control what you are doing with JavaScript(eval()...etc). As far as request being processed by your ASP.NET applications, it does a good job, there are always exceptions.

Upvotes: 1

Related Questions