1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
|
//------------------------------------------------------------------------------
// <copyright file="AntiXssEncoder.cs" company="Microsoft">
// Copyright (c) Microsoft Corporation. All rights reserved.
// </copyright>
//------------------------------------------------------------------------------
namespace System.Web.Security.AntiXss {
using System.Diagnostics.CodeAnalysis;
using System.IO;
using System.Text;
using System.Web.Hosting;
using System.Web.Util;
public class AntiXssEncoder : HttpEncoder {
#region HttpEncoder Methods
// NOTE: No Anti-XSS equivalents for HtmlDecode and HeaderNameValueEncode
protected internal override void HtmlAttributeEncode(string value, TextWriter output) {
if (output == null) {
throw new ArgumentNullException("output");
}
output.Write(UnicodeCharacterEncoder.HtmlAttributeEncode(value));
}
protected internal override void HtmlEncode(string value, TextWriter output) {
if (output == null) {
throw new ArgumentNullException("output");
}
output.Write(HtmlEncode(value, false));
}
protected internal override byte[] UrlEncode(byte[] bytes, int offset, int count) {
if (!HttpEncoder.ValidateUrlEncodingParameters(bytes, offset, count)) {
return null;
}
string utf8String = Encoding.UTF8.GetString(bytes, offset, count);
string result = UrlEncode(utf8String, Encoding.UTF8);
return Encoding.UTF8.GetBytes(result);
}
protected internal override string UrlPathEncode(string value) {
if (String.IsNullOrEmpty(value)) {
return value;
}
// DevDiv #211105: We should make the UrlPathEncode method encode only the path portion of URLs.
string schemeAndAuthority;
string path;
string queryAndFragment;
bool isValidUrl = UriUtil.TrySplitUriForPathEncode(value, out schemeAndAuthority, out path, out queryAndFragment, checkScheme: false);
if (!isValidUrl) {
// treat as a relative URL, so we might still need to chop off the query / fragment components
schemeAndAuthority = null;
UriUtil.ExtractQueryAndFragment(value, out path, out queryAndFragment);
}
return schemeAndAuthority + HtmlParameterEncoder.UrlPathEncode(path, Encoding.UTF8) + queryAndFragment;
}
#endregion
public static void MarkAsSafe(LowerCodeCharts lowerCodeCharts, LowerMidCodeCharts lowerMidCodeCharts,
MidCodeCharts midCodeCharts, UpperMidCodeCharts upperMidCodeCharts, UpperCodeCharts upperCodeCharts) {
// should be callable from console apps
if (HostingEnvironment.IsHosted) {
HttpApplicationFactory.ThrowIfApplicationOnStartCalled();
}
UnicodeCharacterEncoder.MarkAsSafe(lowerCodeCharts, lowerMidCodeCharts, midCodeCharts, upperMidCodeCharts, upperCodeCharts);
}
public static string CssEncode(string input) {
return CssEncoder.Encode(input);
}
public static string HtmlEncode(string input, bool useNamedEntities) {
return UnicodeCharacterEncoder.HtmlEncode(input, useNamedEntities);
}
[SuppressMessage("Microsoft.Design", "CA1055:UriReturnValuesShouldNotBeStrings",
Justification = "As this is meant as a replacement for HttpUility.Encode we must keep the same return type.")]
public static string UrlEncode(string input) {
return UrlEncode(input, Encoding.UTF8);
}
[SuppressMessage("Microsoft.Design", "CA1055:UriReturnValuesShouldNotBeStrings",
Justification = "This does not return a URL so the return type can be a string.")]
public static string HtmlFormUrlEncode(string input) {
return HtmlFormUrlEncode(input, Encoding.UTF8);
}
[SuppressMessage("Microsoft.Design", "CA1055:UriReturnValuesShouldNotBeStrings",
Justification = "This does not return a URL so the return type can be a string.")]
public static string UrlEncode(string input, int codePage) {
return UrlEncode(input, Encoding.GetEncoding(codePage));
}
[SuppressMessage("Microsoft.Design", "CA1055:UriReturnValuesShouldNotBeStrings",
Justification = "This does not return a URL so the return type can be a string.")]
public static string HtmlFormUrlEncode(string input, int codePage) {
return HtmlFormUrlEncode(input, Encoding.GetEncoding(codePage));
}
[SuppressMessage("Microsoft.Design", "CA1055:UriReturnValuesShouldNotBeStrings",
Justification = "This does not return a URL so the return type can be a string.")]
public static string UrlEncode(string input, Encoding inputEncoding) {
// Assuming the default to be UTF-8
if (inputEncoding == null) {
inputEncoding = Encoding.UTF8;
}
return HtmlParameterEncoder.QueryStringParameterEncode(input, inputEncoding);
}
[SuppressMessage("Microsoft.Design", "CA1055:UriReturnValuesShouldNotBeStrings",
Justification = "This does not return a URL so the return type can be a string.")]
public static string HtmlFormUrlEncode(string input, Encoding inputEncoding) {
// Assuming the default to be UTF-8
if (inputEncoding == null) {
inputEncoding = Encoding.UTF8;
}
return HtmlParameterEncoder.FormStringParameterEncode(input, inputEncoding);
}
public static string XmlEncode(string input) {
return UnicodeCharacterEncoder.XmlEncode(input);
}
public static string XmlAttributeEncode(string input) {
// HtmlEncodeAttribute will handle input
return UnicodeCharacterEncoder.XmlAttributeEncode(input);
}
}
}
|
