c# - 如何在允许 HTML 输入的同时防止 XSS(跨站点脚本)

Question

我有一个允许通过 TinyMCE 输入 HTML 的网站丰富的编辑器控件。它的目的是允许用户使用 HTML 格式化文本。

这个用户输入的内容然后被输出给系统的其他用户。

然而，这意味着有人可以将 JavaScript 插入到 HTML 中，以便对系统的其他用户执行 XSS 攻击。

从 HTML 字符串中过滤掉 JavaScript 代码的最佳方法是什么？

如果我对 <SCRIPT> 执行正则表达式检查标记这是一个好的开始，但作恶者仍然可以将 JavaScript 附加到 onclick标签的属性。

是否有一种万无一失的方法来编写所有 JavaScript 代码，同时保持其余 HTML 不变？

对于我的特定实现，我使用的是 C#

Answer 1

Microsoft 已经制作了自己的反 XSS 库，Microsoft Anti-Cross Site Scripting Library V4.0:

The Microsoft Anti-Cross Site Scripting Library V4.0 (AntiXSS V4.0) is an encoding library designed to help developers protect their ASP.NET web-based applications from XSS attacks. It differs from most encoding libraries in that it uses the white-listing technique -- sometimes referred to as the principle of inclusions -- to provide protection against XSS attacks. This approach works by first defining a valid or allowable set of characters, and encodes anything outside this set (invalid characters or potential attacks). The white-listing approach provides several advantages over other encoding schemes. New features in this version of the Microsoft Anti-Cross Site Scripting Library include:- A customizable safe list for HTML and XML encoding- Performance improvements- Support for Medium Trust ASP.NET applications- HTML Named Entity Support- Invalid Unicode detection- Improved Surrogate Character Support for HTML and XML encoding- LDAP Encoding Improvements- application/x-www-form-urlencoded encoding support

它使用白名单方法去除潜在的 XSS 内容。

以下是一些与AntiXSS相关的链接:

• Anti-Cross Site Scripting Library
• Microsoft Anti-Cross Site Scripting Library V4.2 (AntiXSS V4.2)
• Microsoft Web Protection Library