I am having a ASP.Net Web Forms (upgraded to framework 4.0) application that has request validation on all pages. Someone attempting a script injection (entering something like
<script>location.href=dangerurl;</script> into a textbox and submitting) will generate an exception as ASP.Net request validation fails for the input control.
On the pages where HTML editors are used (and page validation is OFF) the input content is sanitised using antixss library.
But when the site went for external review they pointed out that the these textboxes accept text like
<% some text and that it is considered as having stored XSS risk. The
<% character combination is forgiven by the ASP.Net request validator somehow.
I cannot see a way of mounting an attack using this characters
<%. Is the external evaluators observation correct in saying there is an increased XSS risk and if so how to possibly create an XSS vector?