Using MS Anti XSS library for sanitizing HTML

.net asp.net security xss antixsslibrary
Nick picture Nick · Jan 9, 2010 · Viewed 8.6k times · Source

In the intent of preventing XSS attacks, I am updating a page in which we have a textbox that accepts HTML, stores it in a database and retrieves and renders it at a later time.

My understanding is that I can sanitize the HTML using AntiXSS.GetSafeHtmlFragment() method. As long as I do this before storing the HTML in the database, am I covered? Do I need to do anything when the HTML is outputted on a web page?

Also, it appears that the white list is kind of a black box. Is there a way to update this based on our requirements?

Answer

David Hogue picture David Hogue · Jan 9, 2010

You should be set. Though obviously this won't protect you from anything already in the database.

You could use AntiXSS.GetSafeHtmlFragment() while outputting the page instead of when saving. But doing when saving is probably safer. You would not want to do it both while rendering and saving though.

The whitelist is not editable.

Related questions

How to properly sanitize content with AntiXss Library?

I have a simple forums application, when someone posts any content, i do: post.Content = Sanitizer.GetSafeHtml(post.Content); Now, i am not sure if i am doing something wrong, or what is going on, but it does not allow …

Read More
What is the App_Data folder used for in Visual Studio?

When creating a new ASP.NET application in Visual Studio, a couple of files and folders are created automatically. One of those folders is called App_Data. Also when publishing a website by selecting the menu option Build->Publish …

Read More
User Group and Role Management in .NET with Active Directory

I'm currently researching methods for storing user roles and permissions for .NET based projects. Some of these projects are web based, some are not. I'm currently struggling to find the best method to achieve what I'm looking for in a …

Read More