使用antixss防護xss

AntiXSS，由微軟推出的用於防止XSS攻擊的一個類庫，可實現輸入白名單機制和輸出轉�?/span>
文章最後有antixx演示工程下載
 
antixss下載地址
aspx?id=5242">http://www.microsoft.com/download/en/details.aspx?id=5242
 
msi安裝程序，安裝以後，安裝目錄下有如下文件
AntiXSS.chm   包括類庫的操做手冊參數說�?/span>
HtmlSanitizationLibrary.dll    包含Sanitizer�?輸入白名�?
AntiXSSLibrary.dll    包含Antixss，Encoder�?輸出轉義)
使用時在工程內添加引用HtmlSanitizationLibrary.dll 和AntiXSSLibrary.dll
導入命名空間using Microsoft.Security.Application;
 
一、輸入白名單
調用Sanitizer.GetSafeHtmlFragment方法便可,url_c未過濾後的乾淨字串
 
            url = Request.QueryString["url"];
            url_c = Sanitizer.GetSafeHtmlFragment(url);
            Response.Write(url_c);
二、輸出轉�?/span>
 
            //HTML內容編碼
            html_cont = Encoder.HtmlEncode(url);
            //html_cont = url;
 
            //HTML屬性編�?/span>
            input1.Value = Encoder.HtmlAttributeEncode(url);
            //input1.Value = url;
 
            //對js進行編碼
            url_c = Encoder.JavaScriptEncode(url);
            //url_c = url;
 
            //URL編碼
            img1.Src = Encoder.UrlEncode(url);
            //img1.Src = url;
 
 
            XmlDocument xmlDoc;
            XmlNodeList nodeList;
 
            //XML屬性編�?/span>
            isbn = Encoder.XmlAttributeEncode(Request.QueryString["isbn"]);
 
            if (isbn != null)
            {
                xmlDoc = new XmlDocument();
                xmlDoc.Load(Server.MapPath("db.xml"));
                nodeList = xmlDoc.SelectSingleNode("Employees").ChildNodes;
                foreach (XmlNode xn in nodeList)
                {
                    XmlElement xe = (XmlElement)xn;
                    if (xe.GetAttribute("genre") == "張三")
                    {
                        xe.SetAttribute("ISBN", isbn);
                    }
                }
                xmlDoc.Save(Server.MapPath("db.xml"));
            }
 
            //XML內容編碼
            price = Encoder.XmlEncode(Request.QueryString["price"]);
            price = Request.QueryString["price"];
            if (price != null)
            {
                xmlDoc = new XmlDocument();
                xmlDoc.Load(Server.MapPath("db.xml"));
                nodeList = xmlDoc.SelectSingleNode("Employees").ChildNodes;
                foreach (XmlNode xn in nodeList)
                {
                    XmlElement xe = (XmlElement)xn;
                    if (xe.GetAttribute("genre") == "張三")
                    {
                        XmlNodeList nls = xe.ChildNodes;
                        foreach (XmlNode xn1 in nls)
                        {
                            XmlElement xe2 = (XmlElement)xn1;
                            if (xe2.Name == "price")
                            {
                                xe2.InnerText = price;
                            }
                        }
                    }
                }
                xmlDoc.Save(Server.MapPath("db.xml"));
            }
如下爲表示層
 
<asp:Content ID="BodyContent" runat="server" ContentPlaceHolderID="MainContent">
<form action="" id="form1" method="post">
<table border="1">
<tr>
    <td width="100">類型</td>
    <td width="300">POC clickme</td>
    <td width="500">result</td>
</tr>
<tr>
    <td>HTML內容</td>
    <td><a href="?url=%3Cscript%3Ealert(xss)%3C/script%3E" >&lt;script&gt;alert(xss)&lt;/script&gt;</a></td>
    <td><pre id="h1" runat="server" ><%=html_cont %></pre></td>
</tr>
<tr>
    <td>HTML屬�?lt;/td>
    <td><a href="?url=%22%20src=%22javascript:alert(xss)%22" >&quot; src=&quot;javascript:alert(xss)&quot;</a></td>
    <td><input id="input1" runat="server"/></td>
</tr>
<tr>
    <td>js</td>
    <td><a href="?url=test;alert(1);">test;alert(1);</td>
    <td>
        <script type="text/javascript">
            var url = <%=url_c %>;
        </script>
    </td>
</tr>
<tr>
    <td>URL</td>
    <td><a href="?url=javascript:alert(xss)" >javascript:alert(xss)</a></td>
    <td><img id="img1" runat="server" alt="img1" /></td>
</tr>
<tr>
    <td>XML屬性編�?lt;/td>
    <td><a href="?isbn=2-3631-4" >isbn=2-3631-4</a></td>
    <td><%=isbn %></td>
</tr>
<tr>
    <td>XML內容編碼www.2cto.com</td>
    <td><a href="?price=90" >price=90</a></td>
    <td><%=price %></td>
</tr>
</table>
</form>
</asp:Content>