Ajax Control Toolkit Editor Control - 避免XSS攻击
我在 这篇 文章中注意到 Microsoft 所做的不建议在公共站点中使用 Ajax 控件工具包中的编辑器控件，因为存在跨站点脚本攻击的危险。我尝试了一下，即使你专门设置了NoScript=“true”，也有可能添加脚本，从而引入XSS攻击漏洞。就我而言，我们正在制定奖学金申请流程，我们希望所有被提名者都可以使用该流程在线输入论文。我们想获取数据并将其重新显示给审查委员会，但显然，这是一个坏主意。
所以我想知道是否有人知道一种简单的方法来验证内容以允许 HTML，但不允许脚本，也许使用我可以在代码隐藏中使用的 CustomValidator 或正则表达式。我知道最好进行白名单验证而不是黑名单验证，我正在专门寻找这一点。
或者，如果有人知道可以防止 XSS 攻击的类似控件，那也很好。
I noticed in this article that Microsoft does not recommend using the Editor control from the Ajax Control Toolkit in public sites because of the danger of cross-site scripting attacks. I tried it out, and even if you specifically set NoScript="true" it's possible to add script, and therefore, introduce XSS attack vulnerabilities. In my situation, we are working on a scholarship application process, and we had hoped to use this to all nominees to type up an Essay on-line. We wanted to take the data and re-display it to the review board, but obviously, this is a bad idea.
So I'm wondering if anyone knows of a simple way of validating the content to allow HTML, but not script, perhaps using a CustomValidator or a Regular Expression that I can use in the code-behind. I'm aware that it's better to to white list validation and not blacklist validation, 'm specifically looking for that.
Alternatively, if anyone is aware of a similar control that does protect against XSS attacks, that would be good, too.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
最新版本的 AntiXSS 库现在可以进行一些 HTML 清理，我认为这可以满足您的需求。看看 Blowdart 的博客 此处。
2015 年 9 月 15 日更新：
AntiXSS 被纳入 .Net 4.0 Framework，在
.config文件中启用它。The latest release of the AntiXSS library now does some HTML sanitisation which I think will do what you want. Have a look at Blowdart's blog on it here.
UPDATE 15 Sep 2015:
The AntiXSS got rolled into the .Net 4.0 Framework, enable it in your
.configfile.