1
vote
0answers
109 views

How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The site Mustache-Security describes XSS vulnerabilities in KnockoutJS... The vulnerabilities come from the use of eval (or some equivalent) to convert text in the data-bind attribute to executable ...
2
votes
1answer
105 views

.NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when? [closed]

I'm looking at ways to use .NET to prevent XSS attacks and have come across the following methods to encode data: string asdf = WebUtility.UrlEncode(code); string asdf1 = ...
3
votes
1answer
604 views

ASP.NET Web API and potential XSS

I'm wondering if my ASP.NET Web API had an XSS vulnerability as my controller didn't have a method to handle the default GET call. Without the GET method being handled in the code a call to ...
0
votes
1answer
906 views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
0
votes
2answers
420 views

AntiXSS for ASP.NET 1.1

Unfortunately, a client of mine still has an application based on ASP.NET 1.1. Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them. ...