且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

HTT prequestValidationException和跨站点脚本XSS

更新时间:2023-09-11 22:02:10

没有,总之它没有。使用反射请编译它,看看它做什么。在HTML属性的攻击可能是:聚焦状态=警报(1)自动对焦
有没有<或>在这个但它仍然有效。请使用AntiXss并检查OWASP XSS prevention小抄。所以,你需要特别注意,只要你使用的是像文字转义属性。

No, in short it doesn't. Please decompile it using reflector and see what it does. An attack on an html attribute could be: " onfocus=alert(1) autofocus There are no < or > in this yet it still works. Please use AntiXss and check the OWASP XSS prevention cheat sheet. So you need to pay attention especially whenever you are using unescaped attributes like Literal.