Microsoft Web Protection Library (AntiXSS)已经停止更新。该页面指出：“在.NET 4.0中，AntiXSS的一个版本被包括在框架中，并可以通过配置启用。在ASP.NET v5中，基于白名单的编码器将是唯一的编码器。”
我有一个典型的跨站脚本攻击场景：一个ASP.Net Core解决方案，用户可以使用所见即所得的HTML编辑器编辑文本。结果会显示给其他人看。这意味着如果用户在保存文本时注入JavaScript代码，当其他人访问页面时，这些代码可能会执行。
我想能够将某些HTML代码列入白名单（安全的代码），但过滤掉不良代码。
我应该如何做？我在ASP.Net Core RC2中找不到任何帮助我的方法。白名单编码器在哪里？我应该如何调用它？例如，我需要清理通过JSON WebAPI返回的输出。
dot.net core社区有一份关于此问题的维基百科。
您可以在控制器级别（在构造函数中）注入编码器，或者引用System.Text.Encodings.Web。
更多信息可以在这里查看：
https://learn.microsoft.com/en-us/aspnet/core/security/cross-site-scripting
为了执行自动的Xss检查，旧版MVC使用了在System.Web.CrossSiteScriptingValidation类中实现的逻辑。然而，ASP.NET CORE 1中没有这个类。为了重用它，我复制了它的代码：
// <copyright file="CrossSiteScriptingValidation.cs" company="Microsoft">
// Copyright (c) Microsoft Corporation. All rights reserved.
// </copyright>
public static class CrossSiteScriptingValidation
{
private static readonly char[] StartingChars = { '<', '&' };
#region Public methods
// Only accepts http: and https: protocols, and protocolless urls.
// Used by web parts to validate import and editor input on Url properties.
// Review: is there a way to escape colon that will still be recognized by IE?
// %3a does not work with IE.
public static bool IsDangerousUrl(string s)
{
if (string.IsNullOrEmpty(s))
{
return false;
}
// Trim the string inside this method, since a Url starting with whitespace
// is not necessarily dangerous. This saves the caller from having to pre-trim
// the argument as well.
s = s.Trim();
var len = s.Length;
if ((len > 4) &&
((s[0] == 'h') || (s[0] == 'H')) &&
((s[1] == 't') || (s[1] == 'T')) &&
((s[2] == 't') || (s[2] == 'T')) &&
((s[3] == 'p') || (s[3] == 'P')))
{
if ((s[4] == ':') || ((len > 5) && ((s[4] == 's') || (s[4] == 'S')) && (s[5] == ':')))
{
return false;
}
}
var colonPosition = s.IndexOf(':');
return colonPosition != -1;
}
public static bool IsValidJavascriptId(string id)
{
return (string.IsNullOrEmpty(id) || System.CodeDom.Compiler.CodeGenerator.IsValidLanguageIndependentIdentifier(id));
}
public static bool IsDangerousString(string s, out int matchIndex)
{
//bool inComment = false;
matchIndex = 0;
for (var i = 0; ;)
{
// Look for the start of one of our patterns
var n = s.IndexOfAny(StartingChars, i);
// If not found, the string is safe
if (n < 0) return false;
// If it's the last char, it's safe
if (n == s.Length - 1) return false;
matchIndex = n;
switch (s[n])
{
case '<':
// If the < is followed by a letter or '!', it's unsafe (looks like a tag or HTML comment)
if (IsAtoZ(s[n + 1]) || s[n + 1] == '!' || s[n + 1] == '/' || s[n + 1] == '?') return true;
break;
case '&':
// If the & is followed by a #, it's unsafe (e.g. S)
if (s[n + 1] == '#') return true;
break;
}
// Continue searching
i = n + 1;
}
}
#endregion
#region Private methods
private static bool IsAtoZ(char c)
{
return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
}
#endregion
}
为了在所有请求中使用上述类，我创建了一个中间件，它使用CrossSiteScriptingValidation类:
public class AntiXssMiddleware
{
private readonly RequestDelegate _next;
private readonly AntiXssMiddlewareOptions _options;
public AntiXssMiddleware(RequestDelegate next, AntiXssMiddlewareOptions options)
{
if (next == null)
{
throw new ArgumentNullException(nameof(next));
}
_next = next;
_options = options;
}
public async Task Invoke(HttpContext context)
{
// Check XSS in URL
if (!string.IsNullOrWhiteSpace(context.Request.Path.Value))
{
var url = context.Request.Path.Value;
int matchIndex;
if (CrossSiteScriptingValidation.IsDangerousString(url, out matchIndex))
{
if (_options.ThrowExceptionIfRequestContainsCrossSiteScripting)
{
throw new CrossSiteScriptingException(_options.ErrorMessage);
}
context.Response.Clear();
await context.Response.WriteAsync(_options.ErrorMessage);
return;
}
}
// Check XSS in query string
if (!string.IsNullOrWhiteSpace(context.Request.QueryString.Value))
{
var queryString = WebUtility.UrlDecode(context.Request.QueryString.Value);
int matchIndex;
if (CrossSiteScriptingValidation.IsDangerousString(queryString, out matchIndex))
{
if (_options.ThrowExceptionIfRequestContainsCrossSiteScripting)
{
throw new CrossSiteScriptingException(_options.ErrorMessage);
}
context.Response.Clear();
await context.Response.WriteAsync(_options.ErrorMessage);
return;
}
}
// Check XSS in request content
var originalBody = context.Request.Body;
try
{
var content = await ReadRequestBody(context);
int matchIndex;
if (CrossSiteScriptingValidation.IsDangerousString(content, out matchIndex))
{
if (_options.ThrowExceptionIfRequestContainsCrossSiteScripting)
{
throw new CrossSiteScriptingException(_options.ErrorMessage);
}
context.Response.Clear();
await context.Response.WriteAsync(_options.ErrorMessage);
return;
}
await _next(context);
}
finally
{
context.Request.Body = originalBody;
}
}
private static async Task<string> ReadRequestBody(HttpContext context)
{
var buffer = new MemoryStream();
await context.Request.Body.CopyToAsync(buffer);
context.Request.Body = buffer;
buffer.Position = 0;
var encoding = Encoding.UTF8;
var contentType = context.Request.GetTypedHeaders().ContentType;
if (contentType?.Charset != null) encoding = Encoding.GetEncoding(contentType.Charset);
var requestContent = await new StreamReader(buffer, encoding).ReadToEndAsync();
context.Request.Body.Position = 0;
return requestContent;
}
}
默认情况下，编码器使用安全列表，仅限于基本拉丁Unicode范围，并将该范围之外的所有字符编码为它们的字符代码等效项。
有一个AntiXSS.NetStandard.HtmlSanitization包，它是Microsoft Web Protection Library (AntiXSS)的非官方端口到.NET Standard 2.0。