Question

Well, we all know there are always XSS vulnerabilities that can be discovered in the future and can undermine ASP.net’s default request-validation security.

However, by default, validateRequest is true. Therefore, much of the html values cannot be entered into ASP.net textboxes and other inputs in the first place, correct?

Therefore, although it isn’t 100% solid security against XSS, it definitely covers a majority of it right?

I don’t believe I would need to do further HtmlEncodes() or a custom plainText() function every time I spit something to ASP.net html (via .Text = …) from the database, correct?

Answer 1

For the most part you should be protected if you have request validation enabled. Unfortunately, if you need to save markup you will have to strip it first or the validation will throw an HttpRequestValidationException:

See the whitepaper for details: Request Validation – Preventing Script Attacks