I took a scan of a ASP site and it said that request validation was off. It caught it by sending a URL of
example.com/?foo=<script> and received a response URL of
example.com/?foo=<script> (Same one).
I took a look myself, and tried to see what was up. I took a closer look at the source code and saw this below the title tags:
<form name="frm" method="post" action="/default.aspx" id="frm" enctype="multipart/form-data">
When I try the URL that the scanner suggested, the source code changes to this:
<form name="Form" method="post" action="/default.aspx?bar=%3Cscript%3E" id="Form" enctype="multipart/form-data">
which is clearly encoded.
Does this mean that the webapp is protected from XSS, and the scanner found a false-positive?