ASP.NET 4 网站是否需要额外的 XSS 安全保护？
根据我对 ASP.NET 所做的了解以及我自己对各种 XSS 测试的个人测试，我发现我的 ASP.NET 4 网站不需要任何 XSS 防护。
您认为 ASP.NET 4.0 网站除了默认选项之外还需要任何额外的 XSS 安全性吗？我无法在文本字段中输入任何 JavaScript 或任何标签，然后立即打印到页面上。
From what I understand about what ASP.NET does and my own personal testing of various XSS tests, I found that my ASP.NET 4 website does not require any XSS prevention.
Do you think that an ASP.NET 4.0 website needs any added XSS security than its default options? I cannot enter any javascript or any tags into my text fields that are then immediately printed onto the page.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
免责声明 - 这是基于对“可信输出”的非常偏执的定义，但当涉及到网络安全时，我认为您不能太偏执。
在大多数情况下，如果您从任何来源获取输入并将其输出为 HTML，则确实需要更多保护。这包括从文件、数据库等检索的数据 - 不仅仅是文本框。您可以拥有一个完全锁定的网站，并让某人通过其他工具直接访问数据库并能够插入恶意脚本。
即使您从只有受信任的用户才能输入数据的数据库中获取数据，您也永远不知道该受信任的用户是否会无意中从网站复制并粘贴某些恶意脚本。
除非您完全信任将在您的网站上输出的任何数据，并且脚本不可能无意中（或在攻击者或心怀不满的员工的情况下恶意）将危险数据放入系统中，否则您应该清理所有输出。
如果您还没有熟悉以下信息：https://www.owasp.org/ index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet
并检查网站上的其他已知威胁。
如果您错过了，Microsoft.AntiXss 库是一个非常好的工具供您使用。除了 HtmlEncode 函数的更好版本之外，它还具有 GetSafeHtmlFragment() 等不错的功能，当您希望在输出中包含不受信任的 HTML 并对其进行清理时，可以使用它。本文介绍了正确的用法：http://msdn.microsoft.com/en-us/library/aa973813。 aspx 这篇文章很旧，但仍然相关。
Disclaimer - this is based on a very paranoid definition of what "trusted output" is, but when it comes to web security, I don't think you CAN be too paranoid.
In most cases, you do need more protection if you are taking input from ANY source and outputting it to HTML. This includes data retrieved from files, databases, etc - much more than just your textboxes. You could have a website that is perfectly locked down and have someone go directly to the database via another tool and be able to insert malicious script.
Even if you're taking data from a database where only a trusted user is able to enter the data, you never know if that trusted user will inadvertently copy and paste in some malicious script from a website.
Unless you absolutely positively trust any data that will be output on your website and there is no possible way for a script to inadvertently (or maliciously in case of an attacker or disgruntled employee) put dangerous data into the system, you should sanitize all output.
If you haven't already, familiarize yourself with the info here: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet
and go through the other known threats on the site as well.
In case you miss it, the Microsoft.AntiXss library is a very good tool to have at your disposal. In addition to a better version of the HtmlEncode function, it also has nice features like GetSafeHtmlFragment() for when you WANT to include untrusted HTML in your output and have it sanitized. This article shows proper usage: http://msdn.microsoft.com/en-us/library/aa973813.aspx The article is old, but still relevant.
抱歉 Dexter，ASP.NET 4 站点确实需要 XSS 保护。您可能认为内置的请求验证就足够了，虽然它做得很好，但它并不是万无一失的。根据可接受值白名单验证所有输入仍然很重要。
另一件事是，请求验证仅对反射型 XSS 有好处，即嵌入在请求中的 XSS。它对于持久性 XSS 根本没有帮助，因此如果您有其他数据源，但输入验证不那么严格，那么您就会面临风险。因此，您始终需要对输出进行编码，并针对正确的标记上下文（HTML、JavaScript、CSS）对其进行编码。 AntiXSS 非常适合此目的。
面向 .NET 开发人员的 OWASP Top 10 第 2 部分：跨站脚本 (XSS)。
Sorry Dexter, ASP.NET 4 sites do require XSS protection. You're probably thinking that the inbuilt request validation is sufficient and whilst it does an excellent job, it's not foolproof. It's still essential that you validate all input against a whitelist of acceptable values.
The other thing is that request validation is only any good for reflective XSS, that is XSS which is embedded in the request. It won't help you at all with persistent XSS so if you have other data sources where the input validation has not been as rigorous, you're at risk. As such, you always need to encode your output and encode it for the correct markup context (HTML, JavaScript, CSS). AntiXSS is great for this.
There's lots more info specifically as it relates to ASP.NET in OWASP Top 10 for .NET developers part 2: Cross-Site Scripting (XSS).