My web application is built with ASP.Net MVC5. One of the method accept query string params. Security testing has reported that it accepts malicious query string and displays in the body without any modification.
the url including the Query parameters are added to the html output by the MVCContrib pager for pagination.
detailed description below
The name of an arbitrarily supplied URL parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7dc29"style="behavior:url(#default#time2)"onbegin="alert(1)"2d524
was submitted in the name of an arbitrarily supplied URL parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The proof-of-concept attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
I have a QueryString filter looks for blacklist entries @"</?\w+((\s+\w+(\s*=\s*(?:"".*?""|'.*?'|[^'"">\s]+))?)+\s*|\s*)/?>", "<img", "<iframe", "\";", "¼script¾", "embed src"
also i do sanitize the param using Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment()
My question: Is it enough to secure the XSS attack? Or how can I remove the malicious query string?