Question

I have an MVC 3 web application project, and in one page I use NicEdit to allow the user enter formatted text.

When the controller receives the data, the data is in html format… perfect. NicEdit itself don’t allow for script tags, nor onFoo events to be entered directly in elements, but one user with bad intentions can force scripts in and that would not be safe.

1. What can I do to ensure the safety of the incoming data… strip out script tags, find and remove onXyz events… what else?

2. Also, what is the easiest way to do it? Should I use HtmlAgilityPack, or there is a simple function somewhere that will do all the job with a simple call.

   Note: just encoding the whole string is not a valid solution. What I want is a way to ensure that the Html code is safe to render in another page, when someone wants to view the submited content.

Thanks!

Answer 1

You could use the AntiXss library. Dangerous scripts will be removed:

string input = ...
string safeOutput = AntiXss.GetSafeHtmlFragment(input);