.net 4 中有一个新的 <%: %>脚本封装类似于 <%= %>但会进行 html 编码。人们鼓励使用这种新语法。
我的问题是，<%: %> 吗？更好地防御 XSS 还是使用 Microsoft Anti XSS 库？
一位 Microsoft 安全人员曾经告诉我永远不要只使用 HTML Encode，因为它不能很好地提供保护，并且我应该始终使用 Anti XSS 库（或其他库）。 <%: %> 仍然如此吗？或者我可以自信地使用 <%: %>知道它会像人们所说的那样保护我的应用程序免受 XSS 攻击吗？
With .net 4 there's a new <%: %> script enclosure that's like <%= %> but does an html encode. People are encouraging the use of this new syntax.
My question is, does <%: %> protect against XSS better or as well as using the Microsoft Anti XSS library?
A Microsoft security person once told me to never just use HTML Encode as it doesn't protect very well and that I should always use the Anti XSS library (or another library). Is that still true with <%: %>? Or can I confidently use <%: %> knowing it's going to protect my app from XSS like people are saying?
发布评论
评论（2）
HttpUtility.HtmlEncode使用黑名单（排除原则）方法进行编码，这可能为将来新发现的漏洞敞开大门。 Anti-XSS 库（现在称为 Web 保护库，包含代码为了减轻 SQL 注入）使用白名单方法（包含原则），这进一步关闭了大门，并且应该提供更好的安全性。<%: ... %>只是<%= Server.HtmlEncode(string) %>的快捷方式，因此提供了编码器的安全性在您的应用程序中使用。您可以使用任何您喜欢的编码器和新的
<%: ... %>语法，Phil Haack 在 将 Anti-Xss 库连接为默认编码器。请记住，当前 Anti-XSS 库 3.1 需要中等信任才能运行 - 这将在未来版本中解决。HttpUtility.HtmlEncodeuses a black list (principle of exclusions) approach to encoding, which potentially leaves the door ajar for newly discover exploits in the future. The Anti-XSS library (now known as the Web Protection Library and includes code to mitigate SQL injection too) uses a whitelist approach (principle of inclusions) which closes the door a little further and should provide better security.<%: ... %>is just a shortcut for<%= Server.HtmlEncode(string) %>and therefore provides the security of the encoder used in your application.You can use any encoder you like with the new
<%: ... %>syntax and Phil Haack has a great post on hooking up the Anti-Xss library as the default encoder. Bear in mind that currently Anti-XSS library 3.1 requires medium trust to run - this is being addressed for a future release.新语法只能用于转义 HTML 中的原始文本内容。 编辑：和属性。
对于
attributes、Javascript 和其他上下文，您仍然应该使用 Anti-XSS 库，The new syntax should only be used to escape raw text content in HTML. EDIT: and attributes.
For
attributes,Javascript, and other contexts, you should still use the Anti-XSS library,