We have a WebForms input field. The value of this input field is set like textBoxControl.Text = userInputString;
ASP.NET Html encodes this automatically to prevent XSS, but we also use AngularJS. AngularJS decodes the value and if an Angular template syntax is detected, Angular will compile this.
test{{4 * 4}}
This opens up XSS again through Angular Template injection. How can we plug into the WebForms, and Razor Html encoding, to add an extra rule to remove {{}}
characters. Does WebForms and Razor allow this, or will we need to manually call our own AngularEncode(x)
method for all user generated values?
ng-non-bindable
, but our project is large, spanning multiple years, multiple developers. So instead of putting that directive on all non-angular components, we're looking for a more global solution. – Swimburger Jun 6 '17 at 12:21