Automatically HtmlEncode in ASP.NET

Question

Spoiled by Ruby on Rails (3), I expect all my HTML output to be automatically encoded.

I asked this question about script exploits a bit earlier and am now wondering, is there some setting, plugin or extension for ASP.NET that will automatically cause all HTML to be HtmlEncode'ed or do I have to be really careful and ensure that on my own?

Answer 1

Various ASP.NET controls automatically encode HTML with HtmlEncode (and a few do URL encoding with UrlEncode), but it's not universal. Here's a list of controls and what encoding (if any) they do automatically. I don't know if it's updated for .NET 4.0 or not:

Which ASP.NET Controls Automatically Encodes? (this link will ask you to save the document)

This is the blog that the above document is from:

http://blogs.msdn.com/b/sfaust/archive/2008/09/02/which-asp-net-controls-automatically-encodes.aspx

It was originally posted in Sep 2008, so it's probably current for 2.0, but not necessarily 4.0. Still a useful resource to have, though, IMO.

You should also look at the Microsoft Anti-Cross Site Scripting Library 3.1.

As pointed out by balexandre, it appears the Anit-XSS library is now part of the open source Web Protection Library:

Microsoft Web Protection Library

Also, OWASP is a good resource for security information, and they have an Enterprise Security API project (ESAPI) that is available (to varying degrees) in various programming languages. The .NET one is not complete yet, I believe.

OWASP Enterprise Security API

Answer 2

If you're using ASP.NET 4.0 with WebForms, then using the code nugget <%: %> will automatically HtmlEncode the output. If you're using the Razor engine, then all data is HtmlEncoded by default.