Best practice for preventing saving malicious client script in HTML

Question

We have an ASP.NET custom control that lets users enter HTML (similar to a Rich text box). We noticed that a user can potentially inject malicious client scripts within the <script> tag in the HTML view. I can validate HTML code on save to ensure that I remove any <script> elements.

Is this all I need to do? Are all other tags other than the <script> tag safe? If you were an attacker, what else would you attempt to do?

Any best practices I need to follow?

EDIT - How is the MS anti Xss library different from the native HtmlEncode for my purpose?

Answer 1

XSS (Cross Site Scripting) is a big a difficult subject to tackle correctly.

Instead of black-listing some tags (and missing some of the ways you may be attacked), it is better to decide on a set of tags that are OK for your site and only allowing them.

This in itself will not be enough, as you will have to catch all possible encodings an attacker might try and there are other things an attacker might try. There are anti-xss libraries that help - here is one from Microsoft.

For more information and guidance, see this OWASP article.

Answer 2

Have a look at this page:

http://ha.ckers.org/xss.html

to get an idea of different XSS attacks that somebody may try.