反 XSS 库 - 与 ASP .Net 网站（相对于 Web 应用程序）一起使用？
安全审核结果显示，我们的网站可能容易受到 XSS 攻击。目前，我们对此的唯一保护是在所有页面上使用默认的 ValidateRequest="true"。我一直在研究 Microsoft 的 Anti-XSS 库，并在观看 此视频 我想实施安全运行时引擎模块来保护所有页面，而不是手动编码每个单独的项目[1]。
我遇到的问题是使用 SRE 配置生成器生成 antixssmodule.config 文件。它正在寻找程序集，但我们的网站是使用网站项目而不是 Web 应用程序项目构建的，因此未构建到程序集中。我是否仍然能够以某种方式生成配置文件以便我可以使用 SRE，或者也许该文件有一个可下载版本，其中已定义了常用控件？
The results of a security audit revealed that our site may be vulnerable to XSS attacks. Currently the only protection we have against this is by using the default ValidateRequest="true" on all pages. I have been looking into Microsoft's Anti-XSS library and after watching this video I would like to implement the Security Runtime Engine Module to protect all pages rather than manually encoding each individual item [1].
The problem I am having is generating the antixssmodule.config file using the SRE configuration generator. It is looking for an assembly but our site is built using a Website project and not a Web Application project and is therefor not built into an assembly. Am I still able to generate the config file somehow so that I can use SRE, or perhaps there is a download-able version of this file with the commonly exploited controls already defined?
[1] I also can't use the CAT.NET tool to discover all possible vulnerabilities because that tool is looking for an assembly also.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
基本上不行，没有目标程序集就无法生成，因此网站项目将无法工作。当然，您可以使用默认的 web.config 来获取所有 Microsoft Web 控件（我相信）。
然而，SRE 的目的是作为易受攻击的网站的补丁，直到您修复它们为止，这并不是一个永久的解决方案。更好的方法是解决根本问题，并确保在将所有不受信任的输入输出到浏览器之前对其进行编码。
Basically no, you can't generate without a target assembly, so website projects won't work. You could, of course, use the default web.config which gets all the Microsoft web controls (I believe).
However, the SRE is meant as a patch around vulnerable web sites until you can get them fixed, it's not a permanent solution. A better approach would be to address the underlying issues and make sure you're encoding all untrusted input before outputting it to the browser.