Ivan Uzunov Blog

"Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow malicious web users to inject HTML or client-side script into the web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Recently, vulnerabilities of this kind have been exploited to craft powerful phishing attacks and browser exploits."  - Wikipedia

The best way to avoid XSS is to HTMLEncode while displaying the user input data. But sometimes the user is allowed to add HTML content to the web site. In this case using only HTMLEncoding is not an option. So far this is the second time I edit this post based on the comments of three smart and good people. Obviously there is no silver bullet solution here. Trying to remove all the places where potentially malicious data could be embedded is impossible. So the title of the post is not correct anymore since I’m not removing JavaScript Tags. I’m encoding and decoding.

So my solution to the problem is only partial. Partial because I have decided to limit the allowed HTML tags to: <p>, </p>, <br />, <br>, <b>, </b>, <strong>, </strong>, <u>, </u>, <i>, </i>, <strike>, </strike>, _,, ^and.

I allow these tags only in the format above. This means that for example “<p >” will not be evaluated as “<p>”. The idea of limiting the allowed tags to these ones in this format is that thus I hope that there will be no chance that malicious user input is executed. I don’t want to mess with more complicated tags like <a> and <img> for example.

1. HTMLEncode all the user input
2. Decode (using the Replace function) only the allowed HTML tags (the list above)

public static string RemoveJavaScriptTags(string sText)
{     
    StringBuilder sb = new StringBuilder(HttpUtility.HtmlEncode(sText));

    // This will allow <b> and <i> HTML tags
    sb.Replace("&lt;b&gt;", "<b>");
    sb.Replace("&lt;/b&gt;", "</b>");
    sb.Replace("&lt;i&gt;", "<i>");
    sb.Replace("&lt;/i&gt;", "</i>");

    return sb.ToString();
}

Trackback URI | Comments RSS