{var%20f='http://v.t.sina.com.cn/share/share.php?appkey=1515056452',u=z||d.location,p=['&url=',e(u),'&title=',e(t||d.title),'&source=',e(r),'&sourceUrl=',e(l),'&content=',c||'gb2312','&pic=',e(p||'')].join('');function%20a(){if(!window.open([f,p].join(''),'mb',['toolbar=0,status=0,resizable=1,width=440,height=430,left=',(s.width-440)/2,',top=',(s.height-430)/2].join('')))u.href=[f,p].join('');};if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();})(screen,document,encodeURIComponent,'','','https://www.manongdao.com/data/attach/logo/logo.png', '推荐 \"骚年 ilove 的问题《Does ASP.NET MVC 4 require extra XSS handling by d》','https://www.manongdao.com/q-519033.html','页面编码gb2312|utf-8默认gb2312'));){kind=link}
ASP.NET MVC 4 by default ignores HTML input in a post message. If I don't explicitly accept HTML, is there any code I need to write to defend my site against XSS attacks? I won't be using [AllowHtml] or [ValidateInput(false)]. I'm just trying to find out if I should worry about XSS attacks or not. I'm using Razor as my view engine.
相关问题
- MVC-Routing,Why i can not ignore defaults,The matc
- Request.PathInfo issues and XSS attacks
- parameters in routing do not work MVC 3
- There is no ViewData item with the key 'taskTy
- TextBoxFor decimal
相关文章
- How to get a list of connected clients on SignalR
- How do you redirect to the calling page in ASP.NET
- Change color of bars depending on value in Highcha
- The program '[4432] iisexpress.exe' has ex
- ASP.Net MVC 4 Bundles
- How to get server path of physical path ?
- Cannot implicitly convert Web.Http.Results.JsonRes
- entity type has no key defined - Code first
I found an excellent blog post by Amir Ismail that addresses all of your concerns. http://miroprocessordev.blogspot.com/2012/03/save-aspnet-mvc-application-against.html
To summarize what he writes. Razor is encoded default unless
Html.Rawis used.Html.AntiForgeryToken()can be used to create a random token that will protect against CSRF however it requires the user to accept cookies.