Spoiled by Ruby on Rails (3), I expect all my HTML output to be automatically encoded.
I asked this question about script exploits a bit earlier and am now wondering, is there some setting, plugin or extension for ASP.NET that will automatically cause all HTML to be HtmlEncode'ed or do I have to be really careful and ensure that on my own?
Various ASP.NET controls automatically encode HTML with HtmlEncode (and a few do URL encoding with UrlEncode), but it's not universal. Here's a list of controls and what encoding (if any) they do automatically. I don't know if it's updated for .NET 4.0 or not:
Which ASP.NET Controls Automatically Encodes? (this link will ask you to save the document)
This is the blog that the above document is from:
http://blogs.msdn.com/b/sfaust/archive/2008/09/02/which-asp-net-controls-automatically-encodes.aspx
It was originally posted in Sep 2008, so it's probably current for 2.0, but not necessarily 4.0. Still a useful resource to have, though, IMO.
You should also look at the Microsoft Anti-Cross Site Scripting Library 3.1.
As pointed out by balexandre, it appears the Anit-XSS library is now part of the open source Web Protection Library:
Microsoft Web Protection Library
Also, OWASP is a good resource for security information, and they have an Enterprise Security API project (ESAPI) that is available (to varying degrees) in various programming languages. The .NET one is not complete yet, I believe.
If you're using ASP.NET 4.0 with WebForms, then using the code nugget <%: %> will automatically HtmlEncode the output. If you're using the Razor engine, then all data is HtmlEncoded by default.
By default, ASP.Net will not accept postbacks where a Inputcontrol contains html elements. This behaviour is set at a page level by the property ValidateRequest.
If you want to accept postbacks containing html, you need to set ValidateRequest to false and HtmlEncode the userinput yourself on the server before further proceeding
