How do you avoid XSS vulnerabilities in ASP.Net (MVC)?
There's a few ways:
- Use the
<%: %>syntax in ASP.NET MVC2 / .NET 4.0. (Which is just syntactic sugar forHtml.Encode()) - Follow the directions laid out by Phil Haack where it details using the Anti-XSS library as the 'default' encoding engine for ASP.NET.
Watch this video from Scott Hanselman and Phil Haack. They cover XSS, CSRF, JSON Hijacking specifically with ASP.Net MVC.
In ASP.Net 4.0 or later, always use <%: ... %> instead of <%= ... %> ... it does the HTML encoding for you.
Having done that, it's fairly straightforward to grep your code for <%= regularly as a security precaution.
Also, are you using the Microsoft Anti-XSS library?