R – How to prevent XSS when allowing simple formatting and hyperlink in a Sharepoint webpart

asp.netsharepointweb-partsxss

I'm building a webpart for a Sharepoint site that allows the user to enter information into a textbox that will eventually be showed to other users. The problem is that I need to allow simple formatting (bold, italic etc) and also allow the user to enter an url (a <a href="…..). I don't want to expose a XSS exploit since I do not trust the users using my webpart not doing that.

What are my best alternatives when not wanting to write a fully fledged html parser?

There is a SPHttpUtility.HtmlEncodeAllowSimpleTextFormatting(string) that does almost what I need. It allows simple formatting such as <B>, <I>, etc. The problem is that I want to allow hyperlinks as well. Does anyone know if there is some builtin functions in Sharepoint/ASP.NET that does what I want?

If I enable "Enhanced rich text" on a "Multiple Lines of Text" column in a Sharepoint list, it seems to do exactly what I want (it allows formatting and hyperlinks, but not evil stuff) but I cannot figure out how and where it does that?

Best Answer

Microsoft have a project over at CodePlex called AntiXSS that seems to do what I want.

It does however allow more html than I need (I couldn't find a way to control what to allow, maybe I didn't look everywhere), but I think this might be a good solution anyway.

Related Solutions

Php – How to prevent XSS with HTML/PHP

Basically you need to use the function htmlspecialchars() whenever you want to output something to the browser that came from the user input.

The correct way to use this function is something like this:

echo htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

Google Code University also has these very educational videos on Web Security:

Javascript – How to prevent XSS (Cross Site Scripting) whilst allowing HTML input

Microsoft have produced their own anti-XSS library, Microsoft Anti-Cross Site Scripting Library V4.0:

The Microsoft Anti-Cross Site Scripting Library V4.0 (AntiXSS V4.0) is an encoding library designed to help developers protect their ASP.NET web-based applications from XSS attacks. It differs from most encoding libraries in that it uses the white-listing technique -- sometimes referred to as the principle of inclusions -- to provide protection against XSS attacks. This approach works by first defining a valid or allowable set of characters, and encodes anything outside this set (invalid characters or potential attacks). The white-listing approach provides several advantages over other encoding schemes. New features in this version of the Microsoft Anti-Cross Site Scripting Library include:- A customizable safe list for HTML and XML encoding- Performance improvements- Support for Medium Trust ASP.NET applications- HTML Named Entity Support- Invalid Unicode detection- Improved Surrogate Character Support for HTML and XML encoding- LDAP Encoding Improvements- application/x-www-form-urlencoded encoding support

It uses a whitelist approach to strip out potential XSS content.

Here are some relevant links related to AntiXSS:

Related Topic