Brambuz (Community Member) asked a question.
Razor pages XSS
Hi in my MVC .NET 7 project, some razor pages getting an XSS flaw CWE ID 80:
ex: @Html.Raw(sanitiser.Sanitize(Model.Files))
I am modifying my code and adding in all pages HtmlSanitizer.Sanitize:
@Html.Raw(sanitiser.Sanitize(ShowDocuments(Model.Files)))
but my code getting the same flaw.
Please, can you help to resolve this issue?
Thank you in advance.
.png){kind=logo}
Hi @Brambuz (Community Member)
It seems this is not officially supported cleanser function to remediate CWE 80 finding.
I would recommend you to refer one of the cleanser function from here:
https://docs.veracode.com/r/Supported_NET_Cleansing_Functions
Note: Ensure the function you choose addresses CWE 80 (look for the right column.)
Regards,
Kashif S.
Hi Kashif,
I'm wondering why HtmlSanitizer is not one of the cleanser functions recognized by Veracode?
For the recogized sanitizer functions:
Microsoft.Security.Application.AntiXss seems discontinued for long and hasn't been updated since Jan 2012
Microsoft.Security.Application.Sanitizer.GetSafeHtml seems not updated since 2014.
See this post and this post and this post.
Should we still choose AntiXss over HtmlSanitizer ?
Thanks in advance!
https://docs.veracode.com/r/Supported_NET_Cleansing_Functions