当 Sharepoint Web 部件中允许简单格式设置和超链接时，如何防止 XSS？
我正在为 Sharepoint 站点构建一个 Web 部件，允许用户在文本框中输入信息，该文本最终将显示给其他用户。问题是我需要允许简单的格式设置（粗体、斜体等），并允许用户输入 url (a
当我不想编写一个成熟的 html 解析器时，我最好的选择是什么
？ us/library/microsoft.sharepoint.utilities.sphttputility.htmlencodeallowsimpletextformatting.aspx" rel="nofollow noreferrer">SPHttpUtility.HtmlEncodeAllowSimpleTextFormatting(string) 几乎可以满足我的需要。它允许简单的格式化，例如 等。问题是我也想允许超链接。有谁知道 Sharepoint/ASP.NET 中是否有一些内置函数可以实现我想要的功能？
、 Sharepoint 列表中的“多行文本”列，它似乎完全符合我的要求（它允许格式化和超链接，但不允许邪恶的东西），但我不知道它是如何以及在哪里做到这一点的？
I'm building a webpart for a Sharepoint site that allows the user to enter information into a textbox that will eventually be showed to other users. The problem is that I need to allow simple formatting (bold, italic etc) and also allow the user to enter an url (a <a href=".....). I don't want to expose a XSS exploit since I do not trust the users using my webpart not doing that.
What are my best alternatives when not wanting to write a fully fledged html parser?
There is a SPHttpUtility.HtmlEncodeAllowSimpleTextFormatting(string) that does almost what I need. It allows simple formatting such as <B>, <I>, etc. The problem is that I want to allow hyperlinks as well. Does anyone know if there is some builtin functions in Sharepoint/ASP.NET that does what I want?
If I enable "Enhanced rich text" on a "Multiple Lines of Text" column in a Sharepoint list, it seems to do exactly what I want (it allows formatting and hyperlinks, but not evil stuff) but I cannot figure out how and where it does that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
微软在 CodePlex 有一个名为 AntiXSS 的项目，它似乎可以满足我的要求。
然而，它确实允许比我需要的更多的html（我找不到一种方法来控制允许的内容，也许我没有到处寻找），但我认为这可能是一个很好的解决方案。
Microsoft have a project over at CodePlex called AntiXSS that seems to do what I want.
It does however allow more html than I need (I couldn't find a way to control what to allow, maybe I didn't look everywhere), but I think this might be a good solution anyway.