My web application is built with ASP.Net MVC5. One of the method accept query string params. Security testing has reported that it accepts malicious query string and displays in the body without any modification.
the url including the Query parameters are added to the html output by the MVCContrib pager for pagination.
detailed description below
The name of an arbitrarily supplied URL parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload
7dc29"style="behavior:url(#default#time2)"onbegin="alert(1)"2d524 was submitted in the name of an arbitrarily supplied URL parameter. This input was echoed unmodified in the application's response.
I have a QueryString filter looks for blacklist entries
@"</?\w+((\s+\w+(\s*=\s*(?:"".*?""|'.*?'|[^'"">\s]+))?)+\s*|\s*)/?>", "<img", "<iframe", "\";", "¼script¾", "embed src"
also i do sanitize the param using
My question: Is it enough to secure the XSS attack? Or how can I remove the malicious query string?