逃脱/重整asp.net中的HTML安全隐患（约validateRequest工作） [英] Security implications of escaping / reforming html in asp.net (working around validateRequest)

问题描述

我有我asp.Net BARF当我提交表单像＆LT的值;一_ （下划线是空格）。这是坏的 - 最起码我希望能够适当地处理错误，理想情况下，我想用户能够提交任何他们喜欢并且具有与用户期望它的工作。

I'm having asp.Net barf at me when I submit the a form with a value like <a_ (underscore is a space). This is bad - at the very least I want to be able to gracefully handle the error, ideally I'd like the user to be able to submit anything they like and have it work as the user expects.

• 我可以设置 validateRequest =false的在web.config中，但我不希望因为我不明白的安全问题。


• 本文使用JavaScript来逃避HTML，然后建议重新形成的HTML服务器端，但是我也不能确定什么是安全的影响是 - 这是不只是与设置 validateRequest =false的的该控件？

• I could set validateRequest="false" in the web.config, but I don't want to because I don't understand the security implications.
• This article suggested using JavaScript to escape html, and then re-forming the html server side, however I also wasn't sure what the security implications of that was - is this not just the same as setting validateRequest="false" for that control?

推荐答案

绕道走。 ValidateRequest只是一个微弱的企图prevent XSS攻击。虽然这是一个有效的尝试，它导致halfassed安全和困惑的开发者。

Bypass away. ValidateRequest is just a weak attempt to prevent XSS attacks. While it is a valid attempt, it results in halfassed security and confused developers.

的事情的症结是帮助prevent的JavaScript被发送到主机，仅是盲目地送达回升到一个或多个客户端。您可以通过Htm​​lEncoding任何你在网页上，这是你应该首先做而不是依靠ValidateRequest什么显示prevent这一点。

The crux of the thing is to help prevent javascript from being sent to the host, only to be blindly served back up to one or more clients. You can prevent this by HtmlEncoding anything you display in a webpage, which is what you should be doing in the first place instead of relying on ValidateRequest.

我的建议是：

1. 了解了关于XSS攻击


2. 摆脱ValidateRequest的


3. 使用防XSS 库在其位

1. Learn up on XSS attacks
2. Get rid of ValidateRequest
3. Use the Anti-XSS library in its place

这篇关于逃脱/重整asp.net中的HTML安全隐患（约validateRequest工作）的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！