C# 上的跨站点脚本 (XSS) 预防

Question

I have codes below on C# currently detected as a potential XSS attacks during code scanning.

ArrayList ListofProductCodeWithOverQuantity = new ArrayList();
string productCodeClean = Regex.Replace(Row.Cells[5].Text, "[^0-9A-Za-z _-]", ""); 
 
ListofProductCodeWithOverQuantity.Add(productCodeClean);

I did try on the Regex.Replace() functions but this doesn't seem to work in this case. I found a lot of solution of prevention for this XSS attack but mostly on other programming language.

How do I apply for the XSS prevention in this case for C#?

Answer 1

Probably, one of those strings come from user input and ends up on the page.

If you don't check they have the proper encoding to be sure they don't contains executable code, you risk falling into XSS.

So, you should encode your texts before put them on the page.